--- title: WhatsApp Vulnerability Exposed 3.5 Billion Users'... description: Researchers discovered a critical vulnerability in WhatsApp's contact discovery feature that allowed enumeration of phone numbers at 100 million per hour... canonical: https://daily.dev/posts/whatsapp-vulnerability-exposed-3-5-billion-users-information-2zydqyam8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: WhatsApp Vulnerability Exposed 3.5 Billion Users' Information | daily.dev og:description: Researchers discovered a critical vulnerability in WhatsApp's contact discovery feature that allowed enumeration of phone numbers at 100 million per hour... og:url: https://daily.dev/posts/whatsapp-vulnerability-exposed-3-5-billion-users-information-2zydqyam8 og:image: https://api.daily.dev/og/posts/2ZYdQYaM8.png og:image:alt: WhatsApp Vulnerability Exposed 3.5 Billion Users' Information og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # WhatsApp Vulnerability Exposed 3.5 Billion Users' Information **[Collections](https://daily.dev/sources/collections)** · 2 min read · 2 upvotes · 0 comments ## Summary Researchers discovered a critical vulnerability in WhatsApp's contact discovery feature that allowed enumeration of phone numbers at 100 million per hour without rate limiting, potentially exposing metadata of 3.5 billion users. Despite warnings since 2017, Meta only implemented countermeasures after responsible disclosure through their bug bounty program. The flaw exposed profile photos, public keys, timestamps, and device information, highlighting that while end-to-end encryption protects message content, metadata remains vulnerable to exploitation for phishing attacks and user tracking. ## Content Researchers from the University of Vienna and SBA Research have uncovered a significant vulnerability in WhatsApp's contact discovery feature, potentially exposing the phone numbers of 3.5 billion registered users. This security flaw allowed researchers to enumerate phone numbers by querying them at a rate of 100 million per hour from a single IP address without encountering any rate limiting. Such a loophole also enabled access to publicly available metadata, including profile photos, user identification texts, public keys, timestamps, and even device information. Despite an earlier warning in 2017, Meta failed to implement necessary rate limiting on contact discovery requests. This oversight left users' data susceptible to exposure, including sensitive details that could lead to targeted phishing attacks and potential harm for individuals in countries where messaging apps like WhatsApp are banned. In conducting this research, the team responsibly disclosed the vulnerability, utilizing ethical guidelines and ensuring all data collected was deleted after analysis. The findings highlighted that while WhatsApp's end-to-end encryption effectively protects message content, users' metadata remained highly vulnerable, underscoring a critical area for improvement in privacy protection. Meta acknowledged the issue through their bug bounty program and has since implemented countermeasures such as rate-limiting and enhanced visibility controls to prevent such extensive data leaks in the future. However, the response took nearly a year and underlines the importance of swift action in addressing and mitigating potential privacy risks in globally-used platforms like WhatsApp. --- Tags: [#security](https://daily.dev/tags/security), [#privacy](https://daily.dev/tags/privacy), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/whatsapp-vulnerability-exposed-3-5-billion-users-information-2zydqyam8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"WhatsApp Vulnerability Exposed 3.5 Billion Users' Information","url":"https://daily.dev/posts/whatsapp-vulnerability-exposed-3-5-billion-users-information-2zydqyam8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/whatsapp-vulnerability-exposed-3-5-billion-users-information-2zydqyam8"},"datePublished":"2025-11-19T22:03:33.511Z","dateModified":"2025-11-22T14:28:01.005Z","description":"Researchers discovered a critical vulnerability in WhatsApp's contact discovery feature that allowed enumeration of phone numbers at 100 million per hour...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4b77266c83342eb47267adf060939f2e?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4b77266c83342eb47267adf060939f2e?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/whatsapp-vulnerability-exposed-3-5-billion-users-information-2zydqyam8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,privacy,vulnerability","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"WhatsApp Vulnerability Exposed 3.5 Billion Users' Information"}]} ```