WhatsApp iOS: In-app link handler code found with new settings to choose default browser

WhatsApp is developing a feature that allows iPhone users to open any link shared in chats within the app’s own browser, according to code analysis by WABetaInfo. Previously, this capability was limited to specific HTTPS-secured business sites, introduced last year. The new implementation expands this scope to include all hyperlinks found in conversation threads.

Root cause

The change originates from references found in the latest TestFlight build of the iOS application. WABetaInfo identified code that introduces a new configuration option under Settings > Chats. This setting is titled “In-app browser” and serves as the toggle for the functionality. The source material indicates this is an expansion of existing infrastructure rather than a completely new engine, building upon the limited business link support tested previously.

Attack path

This is not a security vulnerability but a feature implementation. The attack path concept does not apply here. Instead, the mechanism involves intercepting link taps within the chat interface. When the setting is enabled, the app renders the external web content inside its own view controller. Users receive a bottom sheet explanation upon first enabling the feature, informing them that links will open within WhatsApp rather than launching the device’s default browser application.

Affected versions

• The feature is currently present in the latest iOS TestFlight build.
• It is not available to general beta testers or public releases yet.
• No specific version number or release timeline has been confirmed by the vendor.
• Previous iterations supported only specific business links, whereas this build targets all chat links.

Mitigation

• Monitor the “In-app browser” option in Settings > Chats if using the TestFlight build.
• Disable the feature if you prefer links to open in your default browser.
• Review the bottom sheet explanation provided when enabling the setting for the first time.
• Note that WhatsApp states it cannot see which specific links users open or share.

Why it matters

Security teams should understand that in-app browsers can alter how users perceive destination URLs. When content renders inside an app, visual cues like the address bar may be hidden or simplified, potentially reducing phishing awareness. Users may assume the app’s endorsement applies to the linked site. Teams usually advise checking whether the in-browser experience displays clear domain indicators. This feature shifts user behaviour away from the default browser, which often has stricter tracking protections and clearer site identity signals.

What to do and how to stay safe: WhatsApp

• Check your iOS WhatsApp settings for the new “In-app browser” toggle if you are a TestFlight participant.
• Decide whether you want links to open in the app or your default browser based on your security preferences.
• Verify that the in-app browser displays clear website domain information before entering sensitive data.
• Remind users that they can restore the default browser behaviour at any time through the same settings menu.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Will this feature replace the default browser for all links?

No, users can choose whether links open directly within WhatsApp or in their default browser via a new settings option.

When will this feature be available to the public?

There is currently no word on when WhatsApp plans to make the feature available to beta testers or the general public.

Can WhatsApp see which links I open?

According to the report, WhatsApp cannot see links shared in the conversation and which ones users open.