WhatsApp, Facebook, Instagram, Messenger (com.instagram.android, com.facebook.orca): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
4 of 387 entries · sorted by elapsed ↓
Showing the report for WhatsApp, Facebook, Instagram, Messenger.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
WhatsApp
NASDAQ
2026-06-20
91d ago
Waiting
Critical
WhatsApp advertises that not even WhatsApp can read your messages, but the Meta AI assistant built into your chats can see the plaintext content once you invoke it, so that promise has a real exception. A separate identifier also links what you do on WhatsApp to your activity on other Meta apps like Instagram and Facebook.
Meta AI embedded inside private end-to-end encrypted chats. FAMILY_DEVICE_ID cross-app tracking identifier. An AI participant with access to plaintext undermines the E2E encryption claim itself
click to expand
GDPR Art. 5(1)(f)GDPR Art. 5(1)(b)GDPR Art. 6+1
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF
Facebook
NASDAQ
2026-06-20
91d ago
Waiting
Critical
Meta keeps data profiles on people who have never made a Facebook account, built from contact lists, tagged photos and address books that other people uploaded. Because you never signed up, you never agreed to Meta's terms and have no way to see, question or delete a profile that exists about you without your knowledge.
Internal shadow-profile database schema confirmed for non-users. Custom Audience ad-matching pipeline present in the binary
click to expand
GDPR Art. 6GDPR Art. 32(1)(a)GDPR Art. 22+1
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF
Instagram
NASDAQ
2026-06-20
91d ago
Waiting
Critical
Instagram's integration with Ray-Ban Meta smart glasses requests permission to read your call log, with no evident connection to sharing photos or video from the glasses. The production app also skips certificate pinning, so traffic between your phone and Meta's servers is not fully protected against interception, for instance on public wifi.
Ray-Ban Meta smart glasses integration declares READ_CALL_LOG. No certificate pinning on the production build
click to expand
GDPR Art. 5(1)(c)GDPR Art. 5(1)(c)GDPR Art. 32(1)(a)
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF
Messenger
NASDAQ
2026-06-20
91d ago
Waiting
Critical
Messenger calls its chats end-to-end encrypted, but the encryption keys come from Meta's own servers, which means Meta itself can issue a substitute key and read the conversation. The promise that nobody but you can read your messages is a marketing claim, not something the cryptography actually guarantees, so a conversation you believe is private could in principle still be accessed by Meta.
Server-side key fetching for "end-to-end encrypted" chats - Meta's own infrastructure can serve a substitute key, meaning the E2E claim is not cryptographically enforced.
click to expand
GDPR Art. 5(1)(f)GDPR Art. 32(1)(a)GDPR Art. 5(1)(a)
Yes
Closed
Disclosure
91d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.