Collected research

Facebook Messenger Bug Hunting - A Bug's E2E Lifecycle

Facebook Messenger Bug Hunting - A Bug's E2E Lifecycle -Samuel Cohen y Luke McLaren - Ekoparty 2024

Luke McLaren and Farah Hawa · docs.google.com · 9 December 2024

Three Meta Messenger bugs: a URL check that treats any domain merely starting with the brand name as genuine, so phishing links get official branding in encrypted chats; an effect icon URL with a bad path that crashes group calls; and negative offsets or lengths in mentions that crash the recipient's encrypted chat.

Record

Document

Facebook Messenger Bug Hunting - A Bug's E2E Lifecycle -Samuel Cohen y Luke McLaren - Ekoparty 2024

Researcher

Luke McLaren and Farah Hawa

Published by

docs.google.com

Date

9 December 2024

Format

Recording

Topic

Other

In the archive

• Collected in the 2024 research round

Related sources

• Messenger Bug Hunting: A Bug's End-to-End Lifecycle Slides

Tags

• url-parsing
• filter-bypass
• dos
• webrtc
• fuzzing
• android
• bug-bounty
• case-study
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Luke McLaren and Farah Hawa, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.