[2607.27510] Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats

Skip to main content

Search arXiv

Press Enter to search · Advanced search

-->

Computer Science > Cryptography and Security

arXiv:2607.27510 (cs)

[Submitted on 29 Jul 2026]

Title:Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats

Authors:Gabriel K. Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, Aljosha Judmayer<br>View a PDF of the paper titled Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats, by Gabriel K. Gegenhuber and 5 other authors

View PDF

Abstract:End-to-end encrypted (E2EE) messaging apps are widely praised for their security and thus also used for sensitive coordination in group chats (e.g., by political decision makers). After Threema and WhatsApp, also Signal and iMessage have recently introduced polls to aid agreement processes in groups. This implicitly sets the expectation that all participants see the same outcome and thus have the same view of the conversation. This property is commonly referred to as transcript consistency (TC). In this work, we demonstrate that today's major E2EE messengers do not guarantee any form of TC for group chats, allowing a malicious group member to selectively omit, reorder, or present altered content to different recipients without triggering warnings in their user interface. We systematically investigate the extent of the problem under a malicious-participant threat model that targets the integrity of the shared transcript, or inconsistent delivery across a user's linked devices. We identify multiple equivocation vectors that range from protocol fallback paths to deliberate use of pairwise delivery channels within groups. We demonstrate concrete exploitation scenarios such as social engineering, evading moderation, and, in particular, rigging polls. Beyond these cross-service design issues, we also uncover implementation-specific behaviors with privacy implications (e.g., device OS fingerprinting). Finally, we contextualize our findings within prior transcript-consistency research and outline practical low-overhead mitigations and UI signaling strategies that can be integrated into state-of-the-art E2EE group protocols.

Comments:<br>Accepted to USENIX Security 2026; Artifacts available at this https URL

Subjects:

Cryptography and Security (cs.CR)

Cite as:<br>arXiv:2607.27510 [cs.CR]

(or<br>arXiv:2607.27510v1 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2607.27510

Focus to learn more

arXiv-issued DOI via DataCite (pending registration)

Journal reference:<br>USENIX Security 2026

Submission history<br>From: Gabriel Karl Gegenhuber [view email]<br>[v1]<br>Wed, 29 Jul 2026 22:54:21 UTC (1,456 KB)

Full-text links:<br>Access Paper:

View a PDF of the paper titled Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats, by Gabriel K. Gegenhuber and 5 other authors<br>View PDF<br>TeX Source

view license

Current browse context:

cs.CR

next >

new<br>recent<br>| 2026-07

Change to browse by:

cs

References & Citations

NASA ADS<br>Google Scholar

Semantic Scholar

export BibTeX citation<br>Loading...

BibTeX formatted citation

&times;

loading...

Data provided by:

Bookmark

Bibliographic Tools

Bibliographic and Citation Tools

Bibliographic Explorer Toggle

Bibliographic Explorer (What is the Explorer?)

Connected Papers Toggle

Connected Papers (What is Connected Papers?)

Litmaps Toggle

Litmaps (What is Litmaps?)

scite.ai Toggle

scite Smart Citations (What are Smart Citations?)

Code, Data, Media

Code, Data and Media Associated with this Article

alphaXiv Toggle

alphaXiv (What is alphaXiv?)

Links to Code Toggle

CatalyzeX Code Finder for Papers (What is CatalyzeX?)

DagsHub Toggle

DagsHub (What is DagsHub?)

GotitPub Toggle

Gotit.pub (What is GotitPub?)

Huggingface Toggle

Hugging Face (What is Huggingface?)

ScienceCast Toggle

ScienceCast (What is ScienceCast?)

Demos

Demos

Replicate Toggle

Replicate (What is Replicate?)

Spaces Toggle

Hugging Face Spaces (What is Spaces?)

Spaces Toggle

TXYZ.AI (What is TXYZ.AI?)

Related Papers

Recommenders and Search Tools

Link to Influence Flower

Influence Flower (What are Influence Flowers?)

Core recommender toggle

CORE Recommender (What is CORE?)

Author

Venue

Institution

Topic

About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs .

Which authors of this...