WhatsApp patches zero-click flaw used with Apple OS bug

Meta-owned WhatsApp said Friday it has patched a serious security flaw in its iOS and macOS apps that was used, together with a separate Apple operating system bug, in targeted zero-click attacks on specific users over the past several months. Company officials warned that while the WhatsApp vulnerability is fixed, affected devices could remain compromised and urged potentially targeted individuals to reset and update their systems.

WhatsApp identified the bug as CVE-2025-55177 and said it affected WhatsApp for iOS prior to version 2.25.21.73, WhatsApp Business for iOS prior to 2.25.21.78, and WhatsApp for Mac prior to 2.25.21.78. In its security advisory, the company said incomplete authorization of linked device synchronization messages could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target device. WhatsApp added that it assessed the flaw, combined with an Apple OS-level vulnerability tracked as CVE-2025-43300, may have been exploited in a sophisticated attack against specific targeted users.

Apple issued emergency updates earlier this month for the OS-level vulnerability and said at the time that it had been used in an...