Title is misleading. The actual article headline is "Exploiting Android Messengers with WebRTC: Part 3" Also, this exploit didn't just affect Signal (it affec

Title is misleading. The actual article headline is "Exploiting Android Messengers with WebRTC: Part 3" Also, this exploit didn't just affect Signal (it affected Google Duo too, for instance), and it appears this has already been patched in Signal: > This exploit was performed on Signal 4.53.6 which was released on January 13, 2020, as Bug 376 had already been patched in Signal by the time I finished the exploit. CVE-2020-6514 was also fixed in later versions, and ASCONF has also been disabled in usrsctp, so the code that caused Bug 376 is no longer reachable. Signal has also recently implemented a feature that requires user interaction for the WebRTC connection to be started when the caller is not in the callee’s contacts. Signal has also stopped using SCTP in their beta version, and plans to add this change to the release client once it is tested. The source for this exploit is available here.