WhatsApp users on some Android phones may have a new privacy issue to worry about. A security researcher named Jose Rodriguez pointed out the issues on September 1. According to his findings, a WhatsApp vulnerability on Android can allow anyone to look through photos on it without a PIN, password, or fingerprint. The researcher noted that this issue mainly got triggered when a WhatsApp video call is received. Subsequent tests led him to conclude that Oppo and Google Pixel models are the most vulnerable to this issue, while Samsung is still secure.
The problem is that when a WhatsApp video call is answered, it seems to bypass the phone’s lock screen security. Once the call is answered from the lock screen, WhatsApp's video effects interface can apparently be reached without even unlocking the screen. The Meta AI image-editing function can lead to the device's photo gallery without any authentication. Pixel 6 Pro running Android 17 and Oppo K13 running ColorOS 16 were reported to allow the bypass, while Samsung Galaxy S25 Ultra didn’t allow that.
On affected phones, this can open the gallery without asking for the phone password. This does not mean every Android phone is at risk. Additionally, to exploit this loophole, the hacker must have access to the device, and a video call must come in. Even with this loophole, only they can access the gallery, and not the other apps on the phone. The risk is still worth taking seriously. A lost phone or one left unattended could give someone a chance to try the trick.
The issue has not been found on iPhones, as WhatsApp calls on iPhone use Apple’s own calling system. The reported Android trick depends on how WhatsApp features work with the Android lock screen.
Users should keep WhatsApp and their phone software updated. It is also worth checking WhatsApp’s photo access and limiting it to only the photos that are needed. Most importantly, do not leave your phone unattended, especially if it contains private photos or important accounts.