
#Whatsapp on #iOS had a severe 0day that was exploited in the wild for some months, and is fixed with august 20th releases https://hackread.com/whatsapp-0-day-exploit-attack-targeted-ios-macos-users/
Last year #signal also had its multi-device functionality exploited in the wild. https://thehackernews.com/2025/02/hackers-exploit-signals-linked-devices.html
FWIW #deltachat has a dumber multi-device sync model, no device linking, depends on being in the same WiFI for setup (therefore no easy remote exploits), and #OpenPGP signatures and verification for ongoing usage (like all other E2EE messages).
