Facebook-owned messaging app WhatsApp has disclosed six previously undisclosed vulnerabilities that the company has now patched. The vulnerabilities are listed on a security site that will provide a comprehensive list of security WhatsApp updates and related vulnerabilities (Common Vulnerabilities and Exposures-CVE).
WhatsApp said five of the six vulnerabilities were patched on the same day, while the last bug took a few days longer. While some of the bugs could be exploited by hackers remotely, the company said it had found no evidence that they had been used in attacks.
About a third of the new vulnerabilities were reported through the Bug Bounty Program , while the rest were discovered in standard checks and using automated systems.
WhatsApp is one of the most popular apps in the world, with more than two billion users. Due to its large number of users, it is a favorite target for hackers, who are constantly trying to find vulnerabilities in the platform.
The new website was launched as part of the company's efforts to provide more transparency regarding vulnerabilities targeting the messaging app
The new dashboard will be updated monthly , or sooner if an attack is discovered that users need to be notified about immediately. It will also offer an archive of past CVEs (from 2018). The site will be CVEs in WhatsApp's code, but it will also report other vulnerabilities in other companies' code.
Last year, WhatsApp patched a vulnerability used by Israeli spyware maker NSO Group. WhatsApp sued the spyware maker, alleging that the company used the vulnerability to secretly deliver the Pegasus spyware to 1,400 devices. Many of those devices belonged to 100 human rights defenders and journalists. NSO denied the allegations.
WhatsApp said in a blog post: “We are very committed to transparency and this site wants to help the wider tech community benefit from our latest security efforts .We strongly recommend that all users ensure they update WhatsApp and their mobile operating systems whenever updates are available.”
