CVE-2025-13476

When establishing a TLS connection, the client sends a ClientHello message containing, among other things, a list of supported ciphers and extensions. In Cloak mode, Viber always uses the same static arrangement of these parameters, creating a unique and recognizable fingerprint (known as JA3 or similar). DPI systems can compare this fingerprint with the application signature and identify the traffic as coming from Viber Cloak mode regardless of the IP address or domain used. As a result, network operators or censors can automatically block such traffic, completely neutralizing the censorship bypass function.

An attacker or network operator using DPI can reliably identify and block proxy traffic generated by the Cloak mode feature, depriving users of the ability to bypass censorship. In environments with restrictive network controls, this exposes users to disclosure of their use of anti-censorship tools.

Apply patches available from the vendor according to the references. The current version of the application is available at https://www.viber.com/en/download/. It is recommended to update as soon as possible to a version containing a fix implementing diversified TLS ClientHello extensions.

Rakuten Viber for Android version 25.7.2.0g and Rakuten Viber for Windows versions 25.6.0.0 through 25.8.1.0 (Cloak mode).