Call, Crash, Repeat: Hacking WhatsApp

Call, Crash, Repeat: Hacking WhatsApp

Speakers: Luke McLaren, Security Researcher, Meta (Epsilon)

Conference: REcon 2025

YouTube: https://www.youtube.com/watch?v=bre5bA-h11I

Overview

With roughly two billion active users worldwide, WhatsApp is the most widely deployed end-to-end encrypted messaging platform on Earth. Its ubiquity makes it both an attractive target for adversaries and a high-value research opportunity for security professionals. At REcon 2025, Luke McLaren — who publishes research under the handle data/local/tmp and recently joined the French security firm Epsilon — presented a detailed walkthrough of four vulnerabilities he discovered across WhatsApp's iOS, Android, and macOS clients. The bugs span the full stack: a trivial URL validation failure in the events feature, a native memory corruption bug in the VoIP signaling layer triggered via malformed PJSIP capability data, a logic error enabling unauthorized video stream access during group voice chats, and a deeper architectural issue resulting in a null-pointer dereference crash across all platforms. Together, the talk demonstrates how a shared C/C++ codebase, a complex calling architecture, and rapidly shipped features create a fertile environment for security vulnerabilities even in a mature, security-conscious application.

Background

▶ Watch: WhatsApp shared codebase: iOS and Android targets explained (9:42)

WhatsApp's Architecture

WhatsApp is available across web, desktop (macOS, Windows), Android, and iOS. The flagship mobile clients are written in Objective-C and Java respectively, but they share a native C and C++ codebase compiled into platform-specific libraries — libwhatsapp.so on Android and the equivalent on iOS and macOS. This cross-platform compilation model means a vulnerability in the shared native code will typically manifest on all platforms simultaneously. Meta's security advisories consistently reflect this: CVEs affecting WhatsApp almost always list iOS, macOS, and Android together.

The calling architecture sits on three main layers:

• XMPP Signaling: WhatsApp's proprietary, closed-source implementation for call establishment and teardown. When a call is initiated, an "offer stanza" is sent across the network containing metadata about the call — codecs, group membership, device capabilities, silence reasons, and more. Subsequent stanzas handle mute, video toggle, screen sharing, and call termination.
• PJSIP: An open-source VoIP library that WhatsApp has heavily modified to handle RTP/RTCP stream construction and encryption. PJSIP is historically significant — CVE-2019-3568, exploited by the NSO Group against approximately 1,400 targets, lived here.
• WebRTC: Responsible for encoding voice and video into data streams. It bundles multiple audio and video codecs, including MLO (Meta's proprietary low-bandwidth audio codec).

The native binaries are stripped of symbols, but WhatsApp's extensive internal logging allows researchers to identify functions by correlating log strings with call trees. Functions in the PJSIP layer can often be matched to upstream PJSIP's GitHub repository, effectively recovering symbol names for a significant portion of the VoIP code.

Research Motivation

McLaren opened with an honest survey of why researchers target WhatsApp. Bug bounty programs like Pwn2Own have historically offered $200,000 for a reliable one-click RCE and $300,000 for zero-click — yet no submissions were made, because the open market pays closer to $8 million for a stable, long-lived WhatsApp zero-click exploit. Meta's bug bounty program accepts less reliable bugs that would be rejected outright in the exploit market, making it a genuinely viable path for researchers who discover partial primitives.

Key Findings

▶ Watch: Critical crash: low-address fault indicating memory corruption (24:36)

McLaren presented four vulnerabilities in order of increasing technical complexity:

1. Event URL Validation Bypass (iOS) — No validation on call URLs embedded in WhatsApp Events, allowing arbitrary site redirection.
2. PJSIP Capability Data Null-Pointer Dereference (iOS, Android, macOS) — Malformed capability data in an XMPP offer stanza triggers an out-of-bounds write to unmapped memory via a null-pointer dereference in pj_get_timestamp, crashing all call participants.
3. Voice Chat Logic Error — Unauthorized Video Stream Access (Android) — A logic flaw in Android's Java parsing layer allows an attacker to inject a crafted XMPP silence stanza to spoof a voice chat context, eventually enabling unauthorized access to a victim's video stream through screen-sharing interaction.
4. Null-Pointer Dereference in Voice Chat Accept Flow (Android) — A secondary null-pointer dereference crash when a recipient attempts to answer a spoofed voice chat call.

Technical Deep Dive

▶ Watch: Attack chain: abusing voice chat state machine (32:06)

Bug 1: Event URL Validation Bypass (iOS)

WhatsApp Events is a feature that allows groups to schedule virtual or in-person meetings with RSVP functionality. Approximately ten minutes before a scheduled call, WhatsApp silently initializes the call in the background and converts a "Respond" button into a "Join Call" button. Tapping that button navigates to a deep-link URL embedded in the event's protobuf payload.

The vulnerability is straightforward: the URL embedded in the event is not validated before navigation. An attacker who creates an event can replace the legitimate WhatsApp call deep-link with any arbitrary URL. On iOS, clicking "Join Call" silently redirects the user to that external site with no visible indicator that they are leaving WhatsApp. The lack of user notification and the trusted context of a scheduled group event make this highly effective for phishing campaigns or as a precursor step to deeper exploitation. The fix — which Meta implemented — was to add link validation before navigation.

Bug 2: PJSIP Capability Data Out-of-Bounds Write

When a user initiates a WhatsApp group call, the caller's device transmits an XMPP offer stanza to all group members. This stanza contains a hierarchy of sub-elements: audio/video codec preferences, resolution data, a group_info element listing all participants, and for the calling device, a capability element. The capability element contains a raw binary stream encoding the device's encoding/decoding abilities.

McLaren's approach: place unexpected data into the capability element's raw byte stream — all zeros, all 0xFF, or other malformed patterns — and observe the effect on connecting devices.

Result: When a victim device joins the call and processes the malformed capability data, it triggers a native crash across Android, iOS, and macOS. Crash analysis in Ghidra reveals the faulting instruction is a store operation in the PJSIP function pj_get_timestamp. The function attempts to write the current timestamp (obtained via clock_gettime) into an offset of a null pointer — address 0x0 + offset. The crash dump on Android shows the VOIP signaling thread, a faulting address near zero, register X9 holding the null base pointer, and register X8 holding the value being written.

McLaren's hypothesis is that the malformed capability data causes an object to be improperly initialized during parsing, leaving a pointer null. When pj_get_timestamp later attempts to use that pointer, it dereferences null. Because the base address cannot be controlled, there is no straightforward path to converting this into an arbitrary write primitive, though the bug does provide a reliable crash-all-call-participants primitive across every supported platform.

The impact in practice: any group call of any size — up to 200 participants — can be crashed simultaneously by a single attacker in the call who sends the malformed offer stanza.

Bug 3: Voice Chat Logic Error and Unauthorized Video Stream

WhatsApp Voice Chats (launched November 2023) are Discord-room-style ambient audio spaces within large groups. Unlike normal calls, they start silently, don't ring group members, and allow participants to freely join and leave. The XMPP offer stanza differentiates voice chats from normal calls via a silence attribute whose reason is set to vc_init or vc_wave (voice chat wave).

The vulnerability is a logic error in Android's Java parsing layer. McLaren found that by constructing a normal video call offer stanza and injecting a vc_init or vc_wave silence reason, Android could be convinced that a video call was actually a voice chat. The Java logic checks the silence reason and switches to voice chat UI and behavior — something that does not happen on iOS or macOS, which handle the parsing differently.

Effect of the spoofed voice chat context: WhatsApp's voice chat interface uses the same visual design elements as its screen-sharing interface — a large center area for the "presenter" and small video tiles at the bottom for participants. When a video call is spoofed as a voice chat, the video streams of participants (who are not supposed to be sharing video) get injected into layout slots that don't normally exist in a voice chat. The participant's camera is not actively streamed at this point — their privacy is not immediately compromised.

However, McLaren's key observation was that when a participant initiates screen sharing within this spoofed voice chat context, the screen-sharing interaction places a video stream into the attacker-controlled layout. Through a specific sequence of state transitions — initiating the spoofed call, having a victim join, and exploiting the screen-sharing UI interaction — it becomes possible to enable the victim's video stream without their knowledge or consent. The victim's camera activates and streams to the attacker while the victim sees no indication their video is active.

This was patched before the talk; the UI was also redesigned, removing the interface that made the exploit path visible.

Bug 4: Secondary Null-Pointer Dereference

Within the same spoofed voice chat setup, McLaren also found that if a recipient attempts to answer the call from the notification drop-down (which WhatsApp labels "Group Voice Call" despite it being a video call), WhatsApp crashes silently with a null-pointer dereference. This is not exploitable but demonstrates how the logic error in the voice chat parsing propagates into multiple code paths.

Demo / Proof of Concept

▶ Watch: Root cause: incorrect audio parameter handling enables corruption (45:28)

McLaren demonstrated each bug with live video recordings captured on his personal test devices. For the PJSIP bug, he showed a custom packet-modification proxy intercepting and rewriting the raw capability bytes in the offer stanza. Two devices — attacker on the left, victim on the right — with separate log streams visible confirmed the native crash occurring on the victim device moments after joining. The crash dump was shown in detail, with register values highlighted to prove the null-pointer dereference.

For the voice chat bug, he demonstrated the progression from spoofed call creation, through the victim joining what appears to be a standard group call, to the eventual activation of the victim's video stream via the screen-sharing interaction. The entire exploit sequence — from call setup to unauthorized video access — was shown in real-time with annotated logs.

He also noted that the groups used in testing were five-person groups entirely composed of his own phone numbers — the normally required minimum group size for voice chats (33 members) was bypassed by the spoofed silence stanza.

Defensive Implications

▶ Watch: Future mitigations: MTE and memory safety defenses (49:54)

For Meta and App Developers:

• Deep-link URLs embedded in user-created content must be validated against an allowlist before navigation, regardless of the UI context that surfaces them. A trusted "Join Call" button creates false confidence that the destination is safe.
• Logic that differentiates call types based on metadata attributes (like silence reason codes) should be implemented consistently across all platform clients. Platform-specific Java parsing code is a common source of divergence from the validated C++ logic.
• Objects initialized from network-controlled data must be validated for null before any method or offset access. A null check before timestamp writes would have prevented the PJSIP crash.
• State machine transitions involving media streams (screen share, video on/off) must enforce that a video stream can only be enabled with explicit, current user consent.

For Users:

• Be skeptical of WhatsApp Event notifications that prompt navigation — particularly events from groups with many members where an attacker could be present.
• Keep WhatsApp updated. These bugs were patched in 2024–2025, and patch velocity for critical messaging platforms is a direct function of how quickly users update.

For Security Researchers:

• The shared C/C++ codebase means a single vulnerability found on one platform should be immediately tested on all others. Ghidra is effective for cross-platform comparison even without symbols.
• PJSIP is a fruitful area: it processes untrusted network data, has a rich attack surface, and has historically produced severe vulnerabilities. Mapping stripped PJSIP functions to the open-source repository is a viable technique.
• "Put weird data in weird spots" is McLaren's framing for an effective first-pass fuzzing philosophy — before deeply reverse-engineering a protocol, try malformed inputs and observe what breaks.

Key Takeaways

• WhatsApp's shared C/C++ codebase across iOS, Android, and macOS means a single native bug typically affects all platforms simultaneously, amplifying the impact of any finding.
• The XMPP offer stanza is a high-value attack surface: it carries extensive untrusted metadata including capability data, silence reasons, and group membership that are processed natively before a call is accepted.
• A logic error in Android's Java parsing of XMPP silence reasons was sufficient to bypass voice chat restrictions and, through a multi-step interaction, enable unauthorized access to a victim's camera.
• The bug bounty economics for WhatsApp are nuanced: Meta accepts unreliable bugs that the open exploit market would not pay for, making it a viable disclosure path even for partial primitives.
• Live demonstration remains the most effective way to communicate impact to a vendor — showing a crash dump and a raw video stream appearing without user consent is more persuasive than a written report.

About the Speaker

Luke McLaren is a security researcher who publishes under the handle data/local/tmp (a reference to Android's scratch directory). He has an extensive background in mobile platform security, particularly in the WhatsApp and Messenger ecosystems on Android and iOS. He previously presented research on Messenger vulnerabilities at ekoparty in Argentina. At the time of REcon 2025, he had recently joined Epsilon, a small French security research firm of approximately 10–15 researchers. He focuses primarily on the WhatsApp VoIP stack and end-to-end encrypted messaging architecture.