Few days back, WhatsApp launched WhatsApp for web. This web client lets users access their WhatsApp account directly from web. Users can access their conversations and contacts. But this web client has few privacy bugs.
Independent security researcher Indrajeet Bhuyan claims to uncover few privacy related issues in this web client. WhatsApp for web allows users to view the photos of any WhatsApp users even if the person is not in the contact list. Profile photo is accessible to all even if user has set the profile image privacy to “Contacts Only.” Vulnerability has been demonstrated in the video embedded below.
Another problem he discovered is the photo syncing bug. If the user deletes the photo sent via mobile WhatsApp version, the image appear blurred and cannot be views. But this photo is still accessible in the web version. But it should not be visible. This vulnerability was also demonstrated in the video.
Whatsapp for web may also contains few other issues. Researchers are already trying to check how secure this web client is.
