Trail of Bits published lessons on 7 April 2026 from its pre-launch security audit of WhatsApp's Private Processing. Meta built the system to run AI features, such as message summarization, on end-to-end encrypted chats. The system processes messages inside trusted execution environments (TEEs) based on AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and NVIDIA confidential GPUs. TEEs are hardware-isolated environments designed to protect the code and data inside them. Trail of Bits says it found 28 issues, eight rated high severity. It says Meta patched the vulnerabilities that compromised WhatsApp's privacy model.[1]
Two high-severity findings involved data outside the attestation measurement, the checksum of the TEE's code that clients check before connecting.[1, 2] Configuration files containing environment variables were loaded after the measurement was taken. A malicious insider could therefore have injected code while attestation still passed. Meta now validates those variables. Advanced Configuration and Power Interface (ACPI) tables, the hardware description a virtual machine reads at boot, were left out of the measurement. That omission would let a malicious hypervisor, the software that manages virtual machines, define fake devices with access to protected memory. Meta now verifies the tables in a custom bootloader, so tampering changes the measurement.[1]
Two other high-severity findings concerned how the client checked attestations.[1, 2] The client trusted the firmware patch level that the firmware itself reported instead of checking it against AMD's signed certificate, which it now does. Attestation reports also carried no timestamp or client-supplied random value, so an attacker who compromised a TEE once could replay its report indefinitely. Meta now includes the TLS client_random nonce in each report.[1]
The final report, dated 26 August 2025, records that Meta resolved 16 issues, partially resolved four and left eight unresolved. The partially resolved findings include two rated high: attestation that is not bound to Meta-specific machines, and confidential virtual machine images that are not yet fully reproducible.[2] Trail of Bits says the eight unresolved issues are rated low or informational.[1, 2]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
ca08a5f873dc6318c4c79b5e7cbaeb9e02cbae1e379f48c92f811d3a6251709f
