WhatsApp Bug Lets Anyone Bypass “View Once” Feature

A newly discovered flaw in WhatsApp’s "View Once" feature allows recipients to bypass privacy protections to save and share media intended to disappear after a single viewing. The issue was formally identified by the Zengo X Research Team.

WhatsApp launched the "View Once" feature in 2021 so that once a recipient views a piece of media, it is automatically deleted, preventing it from being saved or forwarded.

Tal Be’ery, CTO of crypto wallet company Zengo and the lead researcher behind this discovery, noted that the bug allows users to access "View Once" messages through WhatsApp Web by simply overriding a setting in the platform's code. Be’ery stated in the official report that “the only thing that is worse than no privacy, is a false sense of privacy in which users are led to believe some forms of communication are private when in fact they are not."

Further elaborating on the technical aspects, Zengo researchers found that "View Once" messages are essentially the same as normal media messages but with a flag that designates them as "View Once." This flag can be easily toggled off, allowing the media to be downloaded and saved.

The flaw was reported to Meta, WhatsApp’s parent company, in late August 2024. Meta responded by stating they are aware of the issue and are actively rolling out updates to address it. However, Meta's timeline for a complete fix remains unclear. In the meantime, Meta recommends users only send "View Once" messages to trusted contacts, cautioning that even the best-intended privacy features can fail under certain circumstances.

This bug has also been exploited in the wild, with browser extensions making it easy to bypass the "View Once" flag on WhatsApp Web, according to BleepingComputer. One of these extensions has existed for over a year, exposing users to privacy risks for an extended period.

Security experts suggest that WhatsApp must implement stronger measures, such as Digital Rights Management (DRM) solutions, to better control media access.

WhatsApp made headlines just a few months ago for allowing the execution of Python and PHP scripts on WhatsApp for Windows, further stressing the need for ongoing security improvements across the platform.