Yet another Electron implementation of a “secure” app turns out not to be.
The flaw, discovered by researcher Gal Weizman at PerimeterX , is a result of a weakness in how WhatsApp’s desktop was implemented using the Electron software framework, which has had significant security issues of its own in the past . Electron allows developers to create cross-platform applications based on Web and browser technologies but is only as secure as the components developers deploy with their Electron apps.
Gal Weizman, PerimeterX
All of this was possible because the vulnerable versions of WhatsApp Desktop had been developed using an outdated, known vulnerable version of Google’s Chrome browser engine — Chrome . More recent versions of the Chromium engine would catch the malicious code.
According to Facebook, the vulnerability affects WhatsApp Desktop versions 0.3. and earlier, for users who have paired the desktop app with WhatsApp for iPhone versions prior to 2 . . Facebook has shipped new versions of WhatsApp Desktop that use updated browser components.