WhatsApp Patches Zero-Day Zero-Click: The Apple Combo That…

Updated August 3, 2026 — WhatsApp has released emergency updates to fix CVE-2025-55177, an insufficient authorization vulnerability in linked-device message synchronization. The flaw was actively exploited in-the-wild in zero-click targeted attacks against iOS and macOS users, likely chained with CVE-2025-43300, an out-of-bounds write in Apple's ImageIO framework. The unusually drastic recommendation for a full factory reset and Meta's silence on the spyware vendor's identity raise questions about infection persistence.

{"main_topic":"cybersecurity","topics":["cybersec","vulnerabilita","zero-day","exploit","cve","big-tech","meta","apple","mobile"]}

Updated August 3, 2026 — WhatsApp has released emergency updates to fix CVE-2025-55177, an insufficient authorization vulnerability in linked-device message synchronization. The flaw was actively exploited in-the-wild in zero-click targeted attacks against iOS and macOS users, likely chained with CVE-2025-43300, an out-of-bounds write in Apple's ImageIO framework. The unusually drastic recommendation for a full factory reset and Meta's silence on the spyware vendor's identity raise questions about infection persistence.

Key Takeaways

CVE-2025-55177 carries a CVSS 5.4 MEDIUM rating and is classified CWE-863 (Incorrect Authorization): an unauthorized user could trigger processing of content from an arbitrary URL on the target device.
WhatsApp notified fewer than 200 potentially compromised users; early indications point to impact on iPhone, Android, and civil society individuals.
The attack worked without user interaction (zero-click) and has been assessed as chained with Apple's CVE-2025-43300, an out-of-bounds write in ImageIO with CVSS 10 CRITICAL.
CISA added CVE-2025-55177 to the KEV catalog on September 2, 2025, with a patch deadline for U.S. federal agencies set for September 23, 2025.

The Mechanism: Insufficient Authorization in Device Synchronization

The vulnerability resides in WhatsApp's message synchronization protocol for linked devices. According to the official description, the flaw "relates to a case of insufficient authorization of linked device synchronization messages." The National Vulnerability Database confirms the CWE-863 (Incorrect Authorization) classification.

WhatsApp stated the vulnerability "could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device." This mechanism opens a remote attack surface: an actor authenticated in the system — but not authorized to access the specific target — could force the device to process content hosted on an attacker-controlled URL.

The vector is classified CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, scoring 5.4 MEDIUM. The network is reachable (Network), attack complexity is low (Low), low privileges are required (Low), no user interaction (None), unchanged scope, limited confidentiality and integrity impact (Low), no availability impact. The score reflects the narrow direct impact of CVE-2025-55177 alone: chaining with a second flaw is required to achieve code execution.

The Apple Chain: From Arbitrary URL to Code Execution

The element that transforms the WhatsApp flaw from anomaly to critical threat is the probable chaining with CVE-2025-43300. Apple described this vulnerability as weaponized in an "extremely sophisticated attack against specific targeted individuals." It is an out-of-bounds write in the ImageIO framework, causing memory corruption during malicious image processing.

The logical combination is readable even without full technical details: CVE-2025-55177 provides the delivery vehicle (forcing processing of content from an arbitrary URL), CVE-2025-43300 provides the entry point into the operating system (memory corruption on image parsing). Result: code execution without the user touching the device.

"zero-click attack, meaning it does not require any user interaction, such as clicking a link, to compromise their device"
— Donncha Ó Cearbhaill, Amnesty International Security Lab

WhatsApp assessed that its flaw "may have been chained with CVE-2025-43300," confirming the composite nature of the exploit. The NVD explicitly records the combination: "in combination with an OS-level vulnerability on Apple platforms." This attack pattern — consumer app as bridge to OS vulnerabilities — represents a significant evolution in the government spyware landscape.

The Targets and Meta's Silence: Who Fired and Who Is in the Crosshairs

WhatsApp sent in-app notifications to fewer than 200 users, qualifying them as potential targets. The number does not indicate confirmed compromise victims, but subjects for whom anomalous traffic compatible with the campaign was detected. It is a precautionary activation, not a damage tally.

Donncha Ó Cearbhaill, researcher at the Amnesty International Security Lab, confirmed advanced spyware attacks in the last 90 days and specified: "Early indications are that the WhatsApp attack is impacting both iPhone and Android users, civil society individuals among them." His analysis continues: "Government spyware continues to pose a threat to journalists and human rights defenders."

The victim profile — journalists, activists, human rights defenders — and the zero-click technique are signatures consistent with the commercial government spyware market. However, Meta has not identified the responsible vendor. This silence is anomalous: in previous cases (NSO Group, Intellexa, Candiru), WhatsApp pursued legal notifications and public communications. The absence of attribution suggests either an ongoing investigation or a strategic decision against exposure.

The dossier does not specify whether the factory reset recommendation is based on concrete evidence of persistence or on the general precaution typical of spyware contexts. The difference matters: if a persistence mechanism exists that cannot be removed by a simple app update, the risk surface exceeds the WhatsApp perimeter.

Immediate Actions

The versions that fix the vulnerability are: WhatsApp for iOS prior to 2.25.21.73 (released July 28, 2025), WhatsApp Business iOS 2.25.21.78 (August 4, 2025), WhatsApp for Mac 2.25.21.78 (August 4, 2025). Users on these platforms must verify installation of the update.

U.S. federal agencies subject to CISA's binding operational directive must apply the patch by September 23, 2025, the date set by the KEV catalog for CVE-2025-55177.

Users who received an in-app WhatsApp notification must evaluate the recommendation for a full factory reset, with the awareness that this guidance — documented by the source — is not accompanied by public details on the persistence mechanism that would justify it.

Monitoring of CVE-2025-43300 on Apple systems remains relevant regardless of the WhatsApp update, as it is an OS-level flaw with CVSS 10 CRITICAL.

Why This Attack Signals a Shift in the Spyware Market

The strategic novelty is not the zero-click itself — already documented on iMessage, SMS, FaceTime — but the migration toward mainstream messaging platforms with mass installation. Exploiting WhatsApp means reaching billions of devices with a single entry point, rather than relying on OS-specific exposures for individual targets.

App-OS chaining also disintermediates responsibility: WhatsApp patches its own vector, Apple patches its own image parser, but the attacker operates on both. This fragmentation complicates coordinated response and dilutes public pressure on individual vendors.

The factory reset recommendation, unusually drastic for a CVSS 5.4 vulnerability, indicates Meta assesses the overall risk higher than the CVSS score of its flaw alone. The dossier does not document the specific reason for this assessment, but the combination with CVE-2025-43300 and the government spyware context provide a plausible interpretive framework.

For the security sector, the case confirms that the dividing line between consumer vulnerability and critical infrastructure has dissolved: a daily messaging app can become the access channel for targeted intelligence operations against at-risk individuals.

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references