A major privacy loophole has been discovered in WhatsApp for Android users. This flaw allows phones to be locked ... read more

A serious privacy flaw has been discovered in WhatsApp on Android phones, which allows anyone to access your personal photos even when the phone is locked. This issue was first noticed by @VBarraquito and later confirmed by NotebookCheck. This flaw does not allow someone to hack the phone remotely; instead, physical access to the phone is required. However, if the phone is in hand, anyone can bypass the lock screen and directly open the photo gallery using an incoming WhatsApp video call. This means that personal photos can be viewed without any passcode, PIN or fingerprint.

How does this flaw work on WhatsApp?

This method doesn't require any special technical knowledge or hacking skills. It uses the built-in options within WhatsApp video calls. If a WhatsApp video call comes in on a locked Android phone, anyone holding the phone can receive the call. As soon as the call starts, tapping the effects icon on the screen opens a menu with options for effects, filters, and 'font-size:12.0pt;line-height:115%;"Times New Roman","serif"'>There's an option to "Create with Meta AI," which allows you to generate a new image or edit an old one. Once you tap "Edit photo," the phone's entire photo gallery opens. This gallery is fully accessible without the need to unlock the phone.

NotebookCheck tested this on a Google Pixel 6 Pro running Android 17 with the latest security patch. This test found that personal photos saved on the phone were easily accessible without any security checks.

Does not work on all Android phones

The good news is that this vulnerability doesn't work on every Android smartphone. This largely depends on how phone manufacturers handle lock-screen permissions.

Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android.
This is in plain sight. It's not hidden, not a secret feature. Not a hack.
This has already been reported to Meta and Google.#Privacy #Security #Android17 pic.twitter.com/F7wulhNiZ1

— Jose Rodriguez (@VBarraquito) September 1, 2026

NotebookCheck also tested the same process on a Samsung Galaxy S25 Ultra running One UI 8.5. On that phone, tapping "Create with Meta AI" took the user back to the lock screen and asked for a passcode or fingerprint verification.

However, this trick worked on the Oppo K13 running ColorOS 16. Since both the Samsung and Oppo devices tested run Android 16, the difference seems to be due to the companies' custom software, not just Android.

It has no effect on iPhones.

According to the report, iPhone users are completely immune to this issue. Apple's CallKit framework uses the native iPhone calling interface for WhatsApp calls, so the in-call WhatsApp controls don't appear on the screen while the device is locked.