CVE-2020-20093: n/a vulnerability

CVE-2020-20093: The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does...

The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 4, 2024, 14:15 UTC (UTC+00:00)

Security readout for executives and security teams

This issue could make a Messenger link appear misleading to the user. A crafted message may spoof how a URI is represented in the app, increasing phishing and social-engineering risk rather than indicating direct device compromise. Exposure is limited to organizations with users running the listed older Messenger versions on iOS or Android. Business impact is most relevant where Messenger is used for work communications, customer contact, or trusted link sharing. Treat this as a phishing-enablement risk, not a confirmed platform compromise. Prioritize inventory and app updates if Messenger is used in business contexts or present on managed devices. Mitigation focus: Inventory Messenger versions across managed iOS and Android devices.; Update Messenger from official app stores where versions are at or below the listed affected releases.; Check Meta or app-store guidance for confirmed fixed versions and support status..

Prepared: Jun 2, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-20093 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Mar 23, 2022, 21:27 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://github.com/zadewg/RIUSCVE reference · x_refsource_MISC

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.