WhatsApp's View Once bug proves "disappearing" is a promise, not a guarantee

What does "gone forever" mean in an app? If the answer is "hidden from the screen where you'd normally look," then it doesn't mean much. That is the uncomfortable takeaway from the latest WhatsApp "View Once" bug, and it's why we'd treat the feature as a courtesy, not a vault.

What happened, briefly

As Mashable reports, a bug on iOS let people open "View Once" photos and videos as many times as they wanted. It was first described publicly by security researcher Ramshath in a blog post. No technical skill was needed. You went to Settings > Storage and Data > Manage Storage, found the sender's chat, sorted by "Newest," and the supposedly consumed media was still there.

Only iPhone users were affected. Ramshath says he reported it through Meta's bug bounty program, and Meta replied that it already knew and was working on a fix. The fix shipped in WhatsApp 25.2.3 for iOS. One caveat on timing: the syndicated copy of the story on Yahoo is dated January 29, 2025, so this is a resurfacing of an already-patched issue, not a fresh breach.

The bug is small; the pattern is not

On its own, this is a modest flaw. It affected one platform, it's patched, and exploiting it meant the recipient had to go looking. But Mashable also notes this isn't the first time. In September 2024, researchers found that "vanished" content was still reachable through the exact URL of the media file, because it was insecurely stored on WhatsApp's servers. Mashable adds that a similar follow-up problem with the feature was also fixed.

Two different layers, a server and a phone, failed in the same way. In our view, that's the real story. "View Once" is easy to promise on the interface, where you just hide a button and show a message. It is much harder to guarantee in the plumbing: caches, storage managers, backups, server retention. Every one of those places can quietly keep a copy that the feature's name says shouldn't exist.

We think this will keep happening to any app that sells impermanence. The interface is the cheap part. Real deletion has to be correct everywhere the file touches, and one missed spot breaks the promise.

The threat model was never the software

Here's the part we'd argue people underrate. Even a perfectly implemented "View Once" can't stop the person you sent it to from doing something with it. They can photograph the screen with another device, for example. The feature reduces casual re-sharing; it doesn't create trust. That isn't a documented claim about this bug, it's simply how any content that reaches another person's screen works, and it's why we call these tools best effort.

So the useful question isn't "is this feature secure?" but "what happens if it fails?" For a meme or a quick snapshot of your lunch, nothing. For a document, a private photo or anything that could hurt you if it resurfaced, the answer should change what you send.

What we'd do

Three practical things:

• Update the app. Mashable advises updating to the latest version, and the fix landed in WhatsApp 25.2.3 on iOS. If you're on an old build, you're running the version that leaked.
• Treat "View Once" as politeness. Use it to signal "please don't keep this," and send only what you'd survive seeing again.
• Don't send what you can't afford to lose control of. No toggle makes that safe. The only reliable ephemeral content is the content you never sent.

As for Meta, credit where it's due: the fix reportedly arrived fairly quickly after the report. But the repeated pattern suggests that features named "disappearing" should be tested like security features, not like UI polish. Until that's the norm, the honest label would be "disappears if everything works." We'd read the name that way, and we'd advise you to do the same.