WhatsApp's Rust Push: Hardening Media Sharing at Billions of Devices

WhatsApp has rolled out a new security layer built with the Rust programming language, part of its broader strategy to harden defenses against malware targeting media files. The company says the deployment, which spans its media-sharing functionality across multiple platforms and products, represents the largest known rollout of Rust code to end-user devices.

Media Files as an Attack Vector

WhatsApp provides default end-to-end encryption for over 3 billion people, but the platform still must contend with a persistent threat: maliciously crafted media files. While WhatsApp already warns users about dangerous attachments like APKs, rare and sophisticated malware can be hidden inside seemingly benign files such as images or videos. These files might target unpatched vulnerabilities in the operating system, OS-provided libraries, or the application itself.

To address this, WhatsApp is increasingly using Rust—a memory safe language—within its media sharing features. The decision was shaped, in part, by a significant OS-level vulnerability that exposed the limits of legacy approaches to media file protection.

Lessons from the Stagefright Vulnerability

In 2015, Android devices became vulnerable to the Stagefright exploit, a bug in OS-provided libraries that processed media files. Applications like WhatsApp could not patch the underlying flaw themselves. Since OS updates often took months to reach users, WhatsApp sought a way to protect its users without depending on system updates.

At the time, WhatsApp had a cross-platform C++ library called wamedia, developed to send and consistently format MP4 files. The team found they could modify it to detect files that did not adhere to the MP4 standard and might trigger bugs in vulnerable OS libraries on the receiving side. Rolling out this check allowed WhatsApp to protect users from Stagefright far more quickly than relying on OS patching cycles.

Rebuilding wamedia in Rust

Because media checks run automatically on download and process untrusted inputs, WhatsApp identified wamedia as a prime candidate for a memory safe language. Rather than an incremental rewrite, the team developed the Rust version in parallel with the original C++. They used differential fuzzing and extensive integration and unit tests to ensure compatibility between the two implementations.

Two major hurdles surfaced during development:

  • Binary size increase from introducing the Rust standard library.
  • Build system support required for the diverse platforms WhatsApp supports.

WhatsApp made a long-term commitment to building that support. In the end, the team replaced 160,000 lines of C++ (excluding tests) with 90,000 lines of Rust (including tests). The Rust version showed performance and runtime memory usage advantages over the C++ implementation. Given this success, the Rust-based library was fully rolled out to all WhatsApp users across Android, iOS, Mac, Web, Wearables, and other platforms.

The Kaleidoscope Check Ensemble

Over time, WhatsApp has added more checks for non-conformant structures within certain file types, helping to protect downstream libraries from parser differential exploit attempts. The system also examines higher risk file types—even structurally conformant ones—for risk indicators:

  • PDFs are flagged when they contain embedded files or scripting elements, as these are common malware vehicles.
  • Masquerading files are detected when one file type is disguised as another through a spoofed extension or MIME type.
  • Known dangerous file types, such as executables or applications, are uniformly flagged for special handling in the application UX.

WhatsApp calls this ensemble of checks Kaleidoscope. The system protects users from potentially malicious unofficial clients and attachments. While format checks will not stop every attack, this layer of defense helps mitigate many of them.

Deployment at Global Scale

Each month, these libraries are distributed to billions of phones, laptops, desktops, watches, and browsers running on multiple operating systems for people on WhatsApp, Messenger, and Instagram. That makes it the largest deployment of Rust code to a diverse set of end-user platforms and products that WhatsApp is aware of.

Rust's Role in WhatsApp's Security Strategy

WhatsApp's security approach follows a structured process: identify and quantify sources of risk, then reduce that risk through layered defenses. The company points to a track record of reporting CVEs for issues found in its applications, even without evidence of exploitation, to encourage users to update quickly.

In identifying risk, WhatsApp uses internal and external audits, fuzzing, static analysis, supply chain management, and automated attack surface analysis. It recently expanded its Bug Bounty program to include the WhatsApp Research Proxy, a tool designed to make research into WhatsApp's network protocol more effective.

In reducing risk, WhatsApp says the majority of high severity vulnerabilities it published were due to memory safety issues in C and C++ code. To combat this, it invests in three parallel strategies:

  1. Design the product to minimize unnecessary attack surface exposure.
  2. Invest in security assurance for the remaining C and C++ code.
  3. Default to memory safe languages, rather than C and C++, for new code.

WhatsApp has added protections such as Control Flow Integrity (CFI), hardened memory allocators, and safer buffer handling APIs. Developers working in C and C++ receive specialized security training, development guidelines, and automated security analysis on their changes. Strict service-level agreements govern the timeline for fixing issues uncovered by risk identification.

Rust enabled WhatsApp's security team to build a secure, high performance, cross-platform library for media consistency and security checks. Security teams at WhatsApp and Meta are identifying high-impact opportunities for Rust adoption, and the company anticipates accelerating its use of the language over the coming years. This effort is part of a broader defense-in-depth approach to application and user security.