WhatsApp Vulnerability Exposes Unencrypted Chat Histories on macOS, iOS

Key Takeaways

• WhatsApp chat histories on macOS and iOS devices may be stored unencrypted locally.
• This vulnerability allows other apps from the same developer (Meta) to access plaintext chat data without explicit user permission.
• The issue stems from how WhatsApp handles data after end-to-end encryption, not from a flaw in Apple’s sandbox model.
• While end-to-end encryption protects messages in transit, local storage security depends on the application’s implementation.
• Users are advised to secure devices, limit app installations, and update software to mitigate risks.

A recent discovery by security researchers indicates that WhatsApp chat histories on both macOS and iOS devices might be saved in an unencrypted format. This revelation sparks renewed concerns regarding the protection of local data and the potential for cross-application access within Apple’s ecosystem.

The core of the problem, identified by iOS security researchers at Mysk, revolves around WhatsApp’s method of storing its message database locally after messages have been decrypted on a user’s device.

Despite WhatsApp’s robust end-to-end encryption (E2EE) protocol, which secures messages during transmission, this protective layer does not extend to the data once it is stored on the device after a user has accessed it.

WhatsApp Chats Stored Unencrypted

Researchers found that WhatsApp saves chat data in a SQLite database file, typically named “Axolotl.sqlite.”

This file is reportedly located within a shared app group container, specifically:

• group.net.whatsapp.WhatsApp.shared

The shared nature of this container means that other applications developed by Meta, such as Facebook and Instagram, could potentially access this stored data without requiring additional user permissions. This is because these apps share the same developer group permissions.

Apple’s sandboxing model is not violated by this behavior, as shared containers are intentionally designed to facilitate data exchange among applications from the same developer. However, the critical point of concern is that the database stores data in plaintext, meaning it lacks encryption at rest.

These findings underscore a crucial distinction:

• End-to-end encryption safeguards messages as they travel between users.
• Once messages are decrypted on a device, they can be stored in a readable format.
• Local storage security is contingent on the application’s specific implementation, not on E2EE.

Consequently, while adversaries cannot intercept messages during transmission, any compromise of the device itself or unauthorized access by apps within the same container could expose sensitive chat histories.

The exposure of unencrypted chat databases introduces several significant security and privacy risks:

• The possibility of cross-app data access within a single developer’s ecosystem.
• An elevated risk from malicious applications that might exploit shared container permissions.
• The potential for forensic extraction of chat histories from compromised or jailbroken devices.
• Increased vulnerability to insider threats or the misuse of legitimate application privileges.

While there is no public evidence suggesting that Meta is currently exploiting this access, the underlying architectural design raises legitimate questions about the isolation of user data.

This issue impacts both iOS devices and macOS systems running WhatsApp, particularly where shared app containers are utilized. On macOS, where the file system offers greater flexibility, the risk might be more pronounced, especially if endpoint security controls are inadequate.

It is important to acknowledge that Apple’s Data Protection framework can encrypt files based on the device’s state, such as when the device is locked. However, this framework does not guarantee that application-level databases are consistently encrypted in a manner that prevents access by other authorized applications.

What You Should Do

• Enable Strong Device Security: Always protect your devices with robust passcodes and biometric locks (Face ID/Touch ID) to prevent unauthorized physical access.
• Limit App Installations: Exercise caution when installing applications, particularly those from the same developer ecosystem (e.g., Meta apps), to minimize potential cross-app data exposure.
• Keep Software Updated: Regularly update your iOS, macOS, and WhatsApp applications to ensure you benefit from the latest security patches and improvements.
• Consider Alternative Messaging Apps: For high-security use cases, evaluate messaging applications that explicitly offer stricter local storage encryption models.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.