As a messaging app, WhatsApp is no stranger to strange bugs, some that even allow a single message to crash the entire app. We’ve seen a couple of such examples in recent years, and it looks like another one has been discovered. Like before, these look to only affect the Android app versions of the service, and with more ways to access your account now, there is a simple workaround for it.
First shared by Twitter user @BruteBee, if WhatsApp on Android opens a chat, be it individual or group, with a specific link, it would cause the app to crash. The app itself is also not a malicious link of any sort, as it is simply a shortcut to the app’s settings page (wa.me/settings). This affects both the consumer and business versions of the app, specifically on version 2.23.10.77. Though it’s entirely possible that other versions might be affected.
Why would such string crash Whatsapp on Android devices?
Rendering issues?
Submitted URL:
http[://wa.me/settingsEffective URL:
https[://api.whatsapp.com/resolve/?deeplink=%2Fsettings¬_found=1 #infosec #whatsappcrash pic.twitter.com/mFNZFE5Bxw— Brute Bee (@BruteBee) May 29, 2023
Fortunately, the bug itself is not very severe. Sure, opening the wrong chat with the link in it will cause WhatsApp to crash, but once it restarts you can continue using it as normal until you open the chat with the problematic link again. And since this issue is specific to the Android app version, the easy workaround is to sign into your account on WhatsApp Web, and delete the message with the link.
It appears @WhatsApp has fixed the bug! Thanks Everyone for making this tweet reach so far!
At least for wa[.]me/settings
The party is over 😅
PoC:#infosec #whatsappcrash pic.twitter.com/3TgbB9V6ny— Brute Bee (@BruteBee) May 31, 2023
As mentioned, the bug itself isn’t very severe, unless it’s in very active chats that you haven’t silenced. The fact that it can be remedied simply with WhatsApp web also helps. Though the trolling potential was there, since not everyone has their desktop or laptop with them at all times to solve the problem. The good news is that at the time of writing, Meta has already fixed the bug, so you won’t have to worry about it anymore.
(Source: @BrutalBee / Twitter)
