A flaw has been discovered in WhatsApp that could allow hackers to edit users' messages - essentially putting words in their mouths.
Cyber security researchers at Check Point Research demonstrated how the flaw could be exploited at the Black Hat cybersecurity conference in Las Vegas this week.
They developed a tool that makes it possible to alter the text within quoted messages before they are delivered to the recipient.
The tool also allows an attacker to change the names of people sending content in group chats, making it possible to attribute a comment to a different source.
The researchers claim that the tool could be used to incriminate a person or close a fraudulent deal.
It could also give attackers the power to create and spread misinformation from what appear to be trusted sources.
Check Point Research notified WhatsApp about the vulnerability at the end of 2018, but the company has so far failed to address the issue.
"We believe these vulnerabilities to be of the utmost importance and require attention," the researchers said in a blog post .
Responding to the report, Facebook, which owns WhatsApp, said that it carefully reviewed the issue a year ago, and denies there is a problem with WhatsApp's security.
The tool developed by Check Point only allows one person to edit the reply they just received from another person within an entirely private and end-to-end encrypted WhatsApp conversation.
"The scenario described here is merely the mobile equivalent of altering replies in an email thread to make it look like something a person didn't write," a Facebook spokesperson told Mirror Online.
The company added that Check Point's suggested changes to WhatsApp would be worse for user privacy, because they would require WhatsApp to log all messages.
"We need to be mindful that addressing concerns raised by these researchers could make WhatsApp less private - such as storing information about the origin of messages."
The proposed changes would also make it impossible to deliver messages to groups when a single person was not connected to the internet, and prevent users from quote replying to a message sent prior to a new group member joining - both of which would have serious usability problems - according to Facebook.
Luckily the researchers have no intention of releasing their WhatsApp hacking tool into the wild - it was created to provoke discussion.
However, as long as the flaw exists, there is a risk that real hackers could create their own tools to exploit the vulnerability.
"This issue is already a year old. That's millennia in the tech world," said Brian Higgins, security specialist at Comparitech.com.
"Clearly Facebook have their own, probably commercial, reasons for allowing these vulnerabilities to remain on the WhatsApp platform but since they don't seem overly concerned, it's down to the user community to apply a little critical thinking to their online activities.
"If you're worried about the security of your conversations on WhatsApp, then use another chat provider. Change will only happen if people vote with their digital feet."
Facebook said that WhatsApp users always have the option of blocking a sender who tries to spoof messages, and can report problematic content.
It also bans any accounts that try to change WhatsApp and use it to spam users.