CVE-2026-23866

The record

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

Affected packages

Related vulnerabilities

• CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin… CWE-940
• CVE-2026-85085 The Canva Android App before 2.376.0 allowed an external origin to be loaded in a… CWE-940
• CVE-2026-73419 NextAuth.js provides authentication for Next.js. CWE-940
• GHSA-g5qx-h5f3-mp2f TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable… CWE-940
• CVE-2026-54106 The U.S. CWE-940
• CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across… CWE-940
• CVE-2026-44894 Netty is a network application framework for development of protocol servers and clients. CWE-940
• GHSA-x426-x7cc-3fpc @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme… CWE-940