WhatsApp Flaws Expose User Metadata, Revealing Device Operating System Details

Meta’s WhatsApp has quietly begun implementing fixes for critical device fingerprinting vulnerabilities that expose users’ operating system information to potential attackers.

The privacy flaws, affecting over 3 billion monthly active users, could enable threat actors to conduct targeted reconnaissance before launching sophisticated malware campaigns.

Understanding the Fingerprinting Threat

Security researchers Tal Beery discovered that WhatsApp’s end-to-end encryption (E2EE) multi-device protocol inadvertently leaks device metadata.

Under this architecture, each receiving device maintains separate encryption sessions with distinct keys, making individual devices identifiable.

Attackers leveraging WhatsApp as an attack vector can query WhatsApp servers for encryption material and extract device-specific information without any user interaction.

Research published by Gegenhuber et al. in 2025 demonstrated that implementation differences in key ID generation allow attackers to fingerprint victims’ exact operating systems, distinguishing between Android and iPhone devices.

This reconnaissance capability is crucial for advanced persistent threat (APT) actors deploying platform-specific zero-day exploits.

Sending an Android exploit to an iPhone would not only fail but also potentially alert victims and compromise a million-dollar attack infrastructure.

Using proprietary research tools, security analysts recently detected changes in Android’s Signed PK ID generation logic.

Instead of starting at zero and incrementing monthly, the parameter now generates a random value each month.

However, the One-Time PK ID parameter remains vulnerable, as iPhone initialization values still differ significantly from Android’s randomized 24-bit range, enabling continued high-accuracy device differentiation.

While the partial remediation represents progress, WhatsApp implemented the fix without notifying the original vulnerability reporters or assigning Common Vulnerabilities and Exposures (CVE) identifiers.

In one related case, WhatsApp awarded a bug bounty but declined to assign a CVE, citing an insufficient severity threshold.

Security experts argue that CVE documentation serves as an essential communication infrastructure rather than stigmatization, with severity appropriately reflected through CVSS scoring.

Complete randomization across all platforms and improved collaboration with the security research community would better protect WhatsApp’s massive global user base against targeted surveillance and malware campaigns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.