Sale of an RCE exploit for WhatsApp on Android

Vulnerability type: Remote Code Execution (RCE) / Sandbox Escape Affected versions: WhatsApp for Android 2.25.xx–2.26.xx, Privileges obtained: code execution in the context of the WhatsApp process (com.whatsapp) Price: $10 000

The seller claims to be offering an exploit for WhatsApp on Android that enables remote arbitrary code execution by sending a specially crafted image or sticker. According to the seller, successfully exploiting the vulnerability requires only delivery of the message, with no additional action from the user.

The claimed exploit chain uses type confusion and out-of-bounds (OOB) access bugs in the media data handler. According to the author, these bugs enable a controlled write to the WhatsApp process memory and code execution within com.whatsapp. An additional component for a limited sandbox escape is offered for an extra fee.

The seller claims that the exploit works against WhatsApp for Android versions 2.25.xx–2.26.xx, described in the listing as the current stable range at the time of publication. Testing is claimed on Google Pixel 8, Pixel 8 Pro, and Samsung Galaxy S24 smartphones running One UI.

In addition, according to the author, code execution occurs directly in memory, without installing an APK. The package does not include a persistence mechanism. The delivery includes the initial payload, a loader, and a basic template for communicating with the command-and-control server.