WhatsApp Chat Histories Stored Unencrypted on macOS and iOS

The Elephant in the Room: Local Encryption

When security researchers from Mysk dropped their findings on May 24, 2026, the privacy community collectively gasped. WhatsApp, the world's most popular messaging app with end-to-end encryption as its crown jewel, stores your entire chat history in plaintext on iOS and macOS. No encryption at rest. No protection. Just a simple SQLite database sitting in a shared container, waiting to be read.

This isn't a hack or a bug. It's an architectural decision that has existed for years, affecting over two billion users. The database, named Axolotl.sqlite, lives in a shared app group container labeled group.net.whatsapp.WhatsApp.shared. This container is accessible to any app from the same developer group—in this case, Meta. That means Facebook and Instagram, if installed on the same device, can silently read your private conversations without triggering any permission dialog or user notification.

What End-to-End Encryption Doesn't Cover

End-to-end encryption (E2EE) is often misunderstood. It protects messages while they travel from your device to the recipient's device, ensuring no one in between—not even WhatsApp's servers—can read them. However, once a message arrives and is decrypted on your device, it's written to a local database. That database is not encrypted at rest. E2EE secures the journey, not the destination.

The Mysk researchers demonstrated this vulnerability in a public video, showing how a companion Meta app could access and read WhatsApp's full message database without any permission prompt. This is a stark reminder that encryption in transit is only half the battle. Local data security is equally critical, and in this case, Meta has chosen convenience over security.

Who Is at Risk?

If you're using WhatsApp on an iPhone or Mac, you're potentially exposed. The risk escalates if you also have Facebook or Instagram installed on the same device, as those apps can read your WhatsApp chat history without your consent. This isn't just a theoretical concern; it's a designed capability. Even if Meta isn't actively exploiting this access, the architecture allows it.

The impact extends beyond individual privacy. In enterprise environments, where employees use WhatsApp for business communications, this vulnerability could expose sensitive corporate data. Government agencies, too, could potentially access unencrypted local data through legal requests directed at Meta, sidestepping E2EE protections entirely.

The CVE-2026-28910 Connection

Adding fuel to the fire, a recently disclosed macOS sandbox vulnerability, CVE-2026-28910, affects Apple's Archive Utility. This flaw can bypass App Sandbox and Transparency, Consent, and Control (TCC) protections, allowing near-unrestricted filesystem access. When chained with WhatsApp's unencrypted storage, an attacker could potentially extract chat histories from a compromised Mac without any user interaction.

The cybersecurity community is concerned. While no active exploitation has been reported, the combination of these vulnerabilities creates a perfect storm for data theft. It's a wake-up call for Apple and Meta to reevaluate their security postures, especially regarding app group containers and local data encryption.

Immediate Steps to Protect Yourself

• Stop using WhatsApp for sensitive communications. Treat it as you would an unencrypted email service.
• Audit your co-installed apps. If you have Facebook or Instagram alongside WhatsApp, assume they can read your chats.
• Enable a strong device passcode and biometric locks. Apple's Data Protection framework can encrypt files when the device is locked, raising the bar for physical attacks.
• Review cloud backup settings. Ensure WhatsApp backups are encrypted or disabled in iCloud.
• For enterprise users, implement MDM policies to restrict which apps can be installed on corporate devices and enforce separation between personal and professional communication channels.

These steps won't fix the underlying issue, but they mitigate the risk while we wait for Meta to address the problem.

Beyond Encryption: Asking the Right Questions

This incident highlights a critical gap in how we evaluate messaging platforms. We often ask, "Is it encrypted?" but rarely dig deeper. When choosing a communication tool, ask the tough questions: Are messages encrypted at rest on the device? Who holds the encryption keys? Can the platform provider read my messages? What happens to data in shared containers? Has the platform been independently audited?

For organizations, establishing a clear communication security policy is non-negotiable. Define which channels are approved for which types of information and enforce it, especially in regulated industries. The days of assuming a green lock icon means complete privacy are over. True security requires end-to-end protection of data at every stage—transit, storage, and backup.

In the wake of this disclosure, Meta has remained silent, offering no timeline for fixing the issue. Users are left to make their own choices. While WhatsApp remains a dominant force, this revelation should prompt a reevaluation of our trust in the platforms we use daily. After all, privacy isn't just about what happens during transmission; it's about where your data rests when no one is looking.