A newly identified WhatsApp security vulnerability on Android allows physical intruders to access private photo galleries during a video call despite an active lock screen, according to reports from tech portals and public disclosures. Security researcher Jose Rodriguez brought the flaw to light, demonstrating how the app’s AI background creation tool bypasses device restrictions when an incoming call is answered on a locked phone.
How the WhatsApp Video Call Flaw Works on Android
The security issue does not involve a remote cyberattack or hidden malware. According to reporting compiled by tech sites, an attacker requires physical access to a locked Android device to exploit the flaw. When the phone receives a WhatsApp video call, anyone can swipe to answer the incoming communication directly from the lock screen.
Once the video connection connects, the user can tap the effects icon to reveal menus for filters and backgrounds. Selecting the option labeled “Create with Meta AI” leads to a “Edit photo” command. On vulnerable devices, tapping this button opens the complete photo gallery directly, entirely bypassing the Android lock screen pin or fingerprint check. Technical reports confirm that while the gallery opens, the rest of the operating system remains locked, preventing access to other apps or device settings.
Device Variations and Manufacturer Differences
Not all Android hardware behaves the same way when exposed to this exploit.
https://x.com/VBarraquito/status/2094729843761922276
Testing revealed that Google Pixel devices, including the Pixel 6 Pro running Android 17, alongside select Sony Xperia and Oppo handsets (such as the Oppo K13 running ColorOS 16), permitted the photo gallery bypass. By contrast, testing on a Samsung Galaxy S25 Ultra running One UI 8.5 successfully blocked the exploit. On the Samsung device, attempting to access the Meta AI background option immediately redirected the user back to the secure lock screen, requiring biometric authentication or a password. Apple iPhones remain unaffected by this flaw due to strict operating system restrictions enforced by iOS CallKit, as noted by industry reports.
Steps to Protect Your Device and Photos
Because the exploit requires physical possession of the phone, it poses a direct risk if a device is left unattended in public spaces, offices, or at home. Meta and Google have been notified of the vulnerability by researcher Jose Rodriguez.
The software flaw has been addressed in WhatsApp version 2.26.34.81 available via the Google Play Store. Users can protect their data by ensuring their messaging application is updated to the latest version. As an immediate workaround, Android users can adjust their operating system permissions. By navigating to device settings, selecting apps, locating WhatsApp, and modifying permissions, users can revoke or restrict access to photos and videos entirely.
Pro Tip: Verify Your App Version
Frequently Asked Questions
Can hackers access my WhatsApp photos remotely?
No. According to tech security reports, a remote cyberattack over the internet is not possible. The exploit requires physical access to your unlocked or ringing smartphone to answer an incoming video call.
Are iPhones vulnerable to this WhatsApp gallery bug?
No. Apple devices do not have this vulnerability due to iOS CallKit restrictions, as noted in the sources.
What should I do if my phone manufacturer has not released a patch?
You can manually restrict WhatsApp’s access to your media files through your Android system settings under App Permissions until an official update is installed.
Related reading