WhatsApp technical team recently addressed 2 security vulnerabilities in WhatsApp for Android. As per security researchers Remote attackers could have exploited these vulnerabilities to execute malicious code on a target device.
The flaws allow attackers to execute “man-in-the-disk” attacks that is possible when mobile apps use External Storage that is shared across all the applications. Attacker can manipulate certain data being exchanged between mobile app and the external storage
The CVE-2021-24027 vulnerability , in prior to WhatsApp for Android v18.104.22.168 and WhatsApp Business for Android v22.214.171.124, leverages Chrome's support in Android and this can allow an attacker with access to the device’s external storage to read cached TLS material. An attacker can send a specially-crafted HTML file to a victim over WhatsApp, which once opened in the victim’s browser, executes the attacker’s code contained in the HTML file.
The attackers could purposefully throw the exception to force the data being sent to the server to intercept it.
Google has already addressed this vulnerability by introducing the “scoped storage” model in Android 10 that allows each app to access only their own app-specific cache files.
The CVE-2021-24027 vulnerabilities were addressed by WhatsApp with the release of version 126.96.36.199.
WhatsApp users are recommended to use version 188.8.131.52 to rule out the risk associated with the vulnerability. When reached for a response, the company confirmed “The "keys" that are used to protect people's messages are not being uploaded to the servers and that the crash log information does not allow it to access the message contents.”