The vulnerability
Google's Project Zero disclosed a WhatsApp Android bug that enables zero-click malware delivery through group chats. Attackers create a group, add the target plus one of their contacts, then send a malicious media file that auto-downloads without user interaction.
The attack vector is narrow but effective: you need to know at least one of the victim's contacts. Once you have that, scaling to a target list is straightforward. Project Zero rates this as viable for targeted campaigns, not mass attacks.
What Meta did (and didn't do)
Meta pushed a server-side change on November 11, 2025. Google says it only partially resolves the issue. A full client-side patch is still in development.
Meanwhile, Meta rolled out two defensive measures on January 28: "Strict Account Settings" (a lockdown mode) and a Rust-based media processing library called "wamedia." The Rust rollout is WhatsApp's largest library migration globally, aimed at preventing memory-safety exploits similar to Android's 2015 Stagefright vulnerability.
The mitigation playbook
Until the full patch ships, disable auto-download for all media types under Settings > Storage and data > Media auto-download. Set this for mobile data, Wi-Fi, and roaming.
Second layer: turn off Media visibility in Settings > Chats. This keeps downloaded files sandboxed within WhatsApp, away from system libraries that might process them.
Third: restrict who can add you to groups via Settings > Privacy > Groups. Change from "Everyone" to "My contacts" or "My contacts except..." Enterprise users should maintain strict allowlists.
The broader context
WhatsApp claims 2.5 billion monthly users, with APAC as the dominant region. The platform faces increasing scrutiny: an international lawsuit filed in late 2025 alleges Meta can access end-to-end encrypted chats despite its privacy claims.
For enterprise leaders evaluating secure messaging platforms, this matters. WhatsApp remains a business-critical channel in many APAC markets. The defense-in-depth approach (Rust for memory safety, Kaleidoscope for anomaly detection) shows Meta is investing in security architecture, but the lag between disclosure and full patch is notable.
The advice stands: lock down auto-download, restrict group permissions, enable two-step verification. And keep the app updated when the client patch finally ships.