Incomplete Authorization in WhatsApp for iOS and Mac Linked Device Synchronization
CVE-2025-55177

5.4MEDIUM

Key Information:

Vendor: Facebook
Status: WhatSAPp Desktop For Mac; WhatSAPp Business For iOS; WhatSAPp For iOS
Vendor: CVE Published:; 29 August 2025

Badges

🥇 Trended No. 1📈 Trended📈 Score: 4,450👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2025-55177?

CVE-2025-55177 is a vulnerability identified in WhatsApp for iOS and Mac that relates to the synchronization of linked devices. Specifically, this vulnerability arises from incomplete authorization processes that could allow an unauthorized user to cause a target device to process messages from arbitrary URLs. This flaw affects versions of WhatsApp prior to v2.25.21.73 for iOS and v2.25.21.78 for both WhatsApp for iOS and WhatsApp for Mac. The potential exploitation of this vulnerability is concerning, as it could lead to unauthorized data access and manipulation, ultimately compromising user privacy and security on these platforms.

Potential impact of CVE-2025-55177

Unauthorized Data Access: Attackers could exploit this vulnerability to gain access to users' personal information or sensitive data through unauthorized URL processing, compromising user confidentiality.
Targeted Attacks: When leveraged in conjunction with specific OS-level vulnerabilities, such as CVE-2025-43300, CVE-2025-55177 could enable sophisticated attacks aimed at particular users, significantly raising the stakes for targeted individuals.
User Trust Erosion: Exploitations of this nature may lead to a loss of trust in the platform as users become aware of potential security flaws, thereby impacting user retention and overall reputation.

CISA has reported CVE-2025-55177

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-55177 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.