Spoofing Bug in Desktop App Exploited File Extension Trick to Bypass User Trust

Meta has released a security update for WhatsApp for Windows, urging users to upgrade immediately to version 2.2450.6 to fix a vulnerability tracked as CVE-2025-30401. This critical spoofing flaw could allow attackers to trick users into running malicious code simply by opening what appears to be a benign file.

---

How the Attack Works

According to Meta’s advisory, the vulnerability is rooted in how WhatsApp handles file attachments:

“A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the filename extension.”

In simpler terms, an attacker could send a file that looks like an image or document based on its MIME type, while hiding an executable payload using a misleading file extension. If a recipient opens the file manually from within WhatsApp, they may inadvertently launch malware.

---

No Evidence of Active Exploitation

Meta credits an external security researcher for discovering and responsibly disclosing the flaw through its Bug Bounty program. As of now, the company has not confirmed any in-the-wild exploitation of CVE-2025-30401.

However, given WhatsApp’s widespread use—especially on desktop in business environments—the window for abuse could have been significant had it remained unpatched.