important · Signal for iOS
A removed Signal group member can rewrite their own recent message in one victim’s local iOS view.
Affects
Signal for iOS, the encrypted messaging client running on iPhone and iPad
The attacker must have authored the message, retain its timestamp and a one-to-one session with the recipient, and send the edit within 48 hours. Omitting groupV2 context routes the edit through the contact thread, while a thread-blind lookup finds and overwrites the old group message.
Detail and 2 sources
The effect is limited to one recipient’s local iOS view, and Signal 8.7.0.1523 is identified as the fixed release.