{"id":206791,"date":"2026-01-26T17:44:00","date_gmt":"2026-01-26T22:44:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/01\/26\/google-issues-whatsapp-attack-warning-for-all-android-users\/"},"modified":"2026-01-26T18:05:10","modified_gmt":"2026-01-26T23:05:10","slug":"google-issues-whatsapp-attack-warning-for-all-android-users","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/01\/26\/google-issues-whatsapp-attack-warning-for-all-android-users\/","title":{"rendered":"Google Issues WhatsApp Attack Warning For All Android Users"},"content":{"rendered":"

Google Issues WhatsApp Attack Warning For All Android Users<\/a><\/p>\n

https:\/\/www.forbes.com\/sites\/zakdoffman\/2026\/01\/26\/google-issues-whatsapp-attack-warning-for-all-android-users\/<\/a><\/p>\n

Publish Date: 2026-01-26 17:44:00<\/a><\/p>\n

Source Domain: www.forbes.com<\/a><\/p>\n

WhatsApp attack warning<\/span><\/p>\n

AFP via Getty Images<\/p>\n

An interesting start to the week for WhatsApp. Just hours after Telegram\u2019s Pavel Durov warned that Meta\u2019s messenger has \u201cmultiple attack vectors,\u201d comes a report that Google has found a serious WhatsApp vulnerability that \u201copens up (an) attack surface.\u201d<\/p>\n

Any warning from Google\u2019s Project Zero threat hunters is taken seriously. This is the team behind many of the zero-day spyware discoveries plaguing Android and iPhone. This threat affects WhatsApp on Android, and relates to zero-click media downloads. <\/p>\n

Forbes<\/span>Google Changes Gmail After 20 Years\u2014Do Not Lose Your Account Now<\/span>By Zak Doffman<\/span><\/span><\/span><\/p>\n

The attack works when a victim and one of the victim\u2019s contacts are added to a new WhatsApp group. The attacker then makes the victim\u2019s contact an admin of the group, and then sends a malicious media attachment to that group. This will likely be automatically download to the victim\u2019s phone, which then opens the attack surface.<\/p>\n

Google says Meta is currently working on a fix. They “pushed a server change on November 11 that partially resolved the issue, but are working on a comprehensive fix.” Meanwhile, Google tells users to \u201cdisable Automatic Download or enable WhatsApp Advance Privacy Mode, (t0) prevent the file from being automatically downloaded.\u201d<\/p>\n

Attack vulnerability <\/span><\/p>\n

Google Project Zero<\/p>\n

I have warned before that automatically downloading media from any message platform is dangerous. The messaging app is a sandbox, and should contain the threat. But once a file is added to a general media store that all changes.<\/p>\n

This would likely be a targeted attack, Google says, because an attacker must know or guess a contact “making it lower severity than a full contact gating bypass.” But the Project Zero team warns \u201cit\u2019s easy to attempt this many times in quick succession, and likely easy to guess contacts in targeted attacks.\u201d <\/p>\n

Neowin spotted the Project Zero report, and explains it was reported privately to Meta on…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Google Issues WhatsApp Attack Warning For All Android Users https:\/\/www.forbes.com\/sites\/zakdoffman\/2026\/01\/26\/google-issues-whatsapp-attack-warning-for-all-android-users\/ Publish Date: 2026-01-26 17:44:00 Source…<\/p>\n","protected":false},"author":1,"featured_media":206792,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/imageio.forbes.com\/specials-images\/imageserve\/6977ed672bc7db34e8657aee\/0x0.jpg?format=jpg&crop=2048,1153,x1126,y358,safe&height=900&width=1600&fit=bounds","fifu_image_alt":"","footnotes":""},"categories":[46],"tags":[70,27],"class_list":["post-206791","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","tag-google","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/206791"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=206791"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/206791\/revisions"}],"predecessor-version":[{"id":206793,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/206791\/revisions\/206793"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/206792"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=206791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=206791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=206791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}