Researcher Finds Fourth WhatsApp View Once Bypass; Meta Says It Won’t Patch

Summary

Tal Be’ery says a fourth WhatsApp View Once bypass uses a modified client; Meta says unofficial clients are outside the feature’s security model and bug bounty scope. Be’ery also proposed DRM, which Meta says is unsuitable.

Key points

Researcher Tal Be’ery identified a fourth method to save WhatsApp View Once media before it disappears.
The method involves a modified WhatsApp client; Be’ery said a browser extension with WhatsApp Web could enable mass exploitation.
Be’ery withheld technical details to limit malicious use and demonstrated the method in a video.
Meta said the issue is out of scope because it involves an unofficial client, and that View Once is intended for trusted contacts—not as forensic-grade deletion.
Meta said it continues hardening View Once in official clients and that capturing content with another device cannot be fully prevented.
Be’ery proposed DRM; Meta argued it would not fit a private messenger and would not prevent recording with a second device.

Article Details

Event Type: Disclosure of a fourth method to bypass WhatsApp’s View Once feature, followed by Meta’s decision not to patch the issue because it involves a modified client application.
Impact: The bypass can allow View Once media to be downloaded before it disappears; the researcher also said a browser extension used with WhatsApp Web could enable mass exploitation. The article does not report confirmed exploitation of this latest method. Meta considers modified clients outside its security model and bug bounty scope, and says View Once is intended as an additional privacy layer—not forensic-grade data deletion.

People

Tal Be’eryResearcher who identified and demonstrated the latest WhatsApp View Once bypass, reported earlier bypasses, and proposed DRM as a possible mitigation.

Vendors

MetaA researcher has discovered another method to bypass WhatsApp’s View Once feature, but Meta does not plan to patch it because it involves a modified client application.

Products

WhatsAppA researcher has discovered another method to bypass WhatsApp’s View Once feature, but Meta does not plan to patch it because it involves a modified client application.WhatsApp WebBe’ery pointed out that an attacker could also leverage a browser extension and WhatsApp Web for mass exploitation.