WhatsApp Android Flaw Can Expose Photos on Some Locked Phones

A loophole in WhatsApp’s in-call effects interface allows someone with physical access to a locked Android device to view photos without unlocking it. Publicly disclosed on September 1, 2026, by security researcher Jose Rodriguez (@VBarraquito), the Android privacy bug occurs when a locked phone receives a WhatsApp video call.

By tapping through standard in-call menus   Effects → Backgrounds → Create with Meta AI → Edit photo, an attacker can bypass the lock screen PIN or biometric check to reach the device’s photo gallery. WhatsApp’s official X account (@WhatsApp) posted that the company was rolling out a fix, describing the issue as

“limited to a rare case when someone has physical access to a user’s device.”

No specific patched version number has been confirmed in official documentation. Exposure is device-dependent: some Android phones reproduce the lockscreen vulnerability, others do not.

This article explains what has been reported and reproduced, which devices have been tested, what the flaw appears to involve, and what you can do about it. Where the evidence is solid, it is cited as such. Where the explanation involves inference, it is labeled accordingly.

Reported Behavior: How the WhatsApp Lockscreen Vulnerability Works

The following sequence was demonstrated by Rodriguez and independently reproduced by NotebookCheck on specific devices:

1. A WhatsApp video call arrives while the Android phone is locked.
2. The person holding the phone answers the call from the lockscreen no unlock required, which is standard behavior.
3. Inside the active call, they tap the Effects icon.
4. They navigate to Backgrounds.
5. They select Create with Meta AI.
6. They choose Edit photo.
7. On affected devices, the phone’s photo gallery opens without prompting for a PIN, pattern, or biometric.

The sequence uses only standard options inside WhatsApp’s call interface. It requires no special tools, no developer mode, and no technical skill. Rodriguez’s own description: “This is in plain sight. It’s not hidden, not a secret feature. Not a hack.”

The rest of the device other apps, settings, files remains behind the lockscreen. What becomes accessible through this path appears to be limited to the photo gallery viewer. There is no confirmed evidence in current reporting that the attacker can freely navigate the device or exfiltrate files directly; a person with access to the exposed gallery would need a second device to photograph what is displayed on screen.

Which Devices Are Affected by This Android Privacy Bug?

Behavior varies significantly by device. Here is a quick reference based on published testing:

Devices confirmed affected in published testing:

• Pixel 6 Pro   Android 17   Affected
• Oppo K13   ColorOS 16   Affected

Not affected in published testing:

• Samsung Galaxy S25 Ultra   One UI 8.5   Blocked
• iPhone   iOS   Not affected through this reported path

Important: This is not exhaustive testing across all devices or Android versions.

Testing is not exhaustive. Results reflect specific device and software combinations only.

Additional coverage mentions vivo devices as potentially affected. Still, specific model and software version details have not been documented in primary reporting at the time of writing. Do not treat “vivo” as a confirmed category without device-level evidence.

The Samsung result is notable

Both the Oppo K13 and Samsung Galaxy S25 Ultra run Android 16, yet produce opposite outcomes. This suggests the difference is not driven by Android version alone, but by how each manufacturer’s software layer handles the interaction between call UI and the media picker, though the precise mechanism has not been publicly confirmed by Meta, Google, or the OEMs involved.

Why This Appears to Happen (Technical Interpretation   Not Vendor-Confirmed)

The following is an interpretive analysis based on observed behavior and publicly documented Android architecture. Meta, Google, or any OEM have not confirmed it.

Android’s lockscreen behavior involves a combination of OS-level policy, app-specific window flags, and device-specific customizations. Some interactions, such as answering an incoming phone call, are intentionally designed to be available before the device is unlocked. However, the exact scope of what is permitted varies by implementation.

WhatsApp’s in-call effects interface appears to be rendered in a pre-unlock context, consistent with standard Android behavior for call-related UI. The observed issue is that the photo editing path within that effects interface appears to invoke a media selection flow without triggering an authentication re-check. On some devices and software configurations, that media flow then returns gallery content in the same pre-authenticated context.

Whether WhatsApp’s implementation causes this, the Android media framework, OEM lockscreen policy, or some combination of these is not established in current public reporting. Samsung’s behavior blocking gallery access and redirecting to the lockscreen demonstrates that at least one OEM enforces an additional authentication gate before this flow completes. Other tested devices do not.

What Attackers Can and Cannot Access in WhatsApp

Can access

• Photos visible in the gallery viewer through the exposed path

Cannot access (based on current reporting):

• Other apps or data stores
• The device’s general file system
• Settings or credentials
• Remote access or persistence

Practical secondary risk

A person with access to the gallery display could photograph the screen with a second device, creating a real privacy risk for anyone storing sensitive images, IDs, financial documents, medical images, or personal photos.

Mitigation: How to Protect Yourself from This WhatsApp Security Issue

1. Install the WhatsApp Security Update

WhatsApp publicly stated it was rolling out a fix in a post on its official X account (@WhatsApp), which read: “We’ve begun rolling out a fix for this issue, which is limited to a rare case when someone has physical access to a user’s device.” That is the clearest public confirmation from Meta identified at the time of writing.

Update WhatsApp through the Google Play Store as soon as possible. At the time of writing, the specific patched version number has not been independently verified in primary documentation available to this author. Check Meta’s official security advisory for version confirmation once published.

2. Restrict WhatsApp’s Photo Access

9to5Google and NotebookCheck have both reported that limiting WhatsApp’s photo and video permission to “selected” or “limited” access can reduce or break the exposed path on affected devices. This is worth doing regardless of patch status.

How to restrict it:

• Open Settings → Apps → WhatsApp → Permissions → Photos and videos
• Change from full access to Select photos and videos (Android 13 and later) or the equivalent restricted option on your device

This is reported as an effective workaround, but test it on your specific device model rather than assuming universal behavior, because OEM permission UX and enforcement vary.

3. Minimize Physical Access Exposure

Since exploitation requires physical possession of the device, keep your device with you or in a secure location when locked, set a short auto-lock timeout, and enable remote wipe through Google Find My Device.

4. Patch Validation (for Security Teams)

If you manage a device fleet, validate patch status model by model. The Samsung result shows that OEM behavior differs even on the same Android version, so confirming a WhatsApp update alone is not a sufficient fleet-wide signal. After updating, test the reported workflow on a device you control. A patched implementation should either hide the Edit photo path in a locked-call context, trigger an authentication prompt at that step, or return to the lockscreen before opening any gallery content.

Also Read: All Solid-State Batteries Explained

Why iPhones Are Not Affected by This Lockscreen Vulnerability

When WhatsApp receives an incoming call on a locked iPhone, iOS presents Apple’s native call interface rather than WhatsApp’s custom in-call screen. This means the Meta AI effects interface and the photo editing path it contains are not reachable from the lockscreen on iOS. The technical reason specific to this case is that WhatsApp’s custom call UI on iOS defers to a system-controlled interface that does not expose the app’s in-call features in a pre-authentication state.

This is not a broad statement that all VoIP apps on iOS are categorically immune to all lockscreen issues. It is specific to how WhatsApp calls are presented on a locked iPhone in the context of this particular flaw.

WhatsApp Lockscreen Vulnerability Summary

A loophole in WhatsApp for Android, demonstrated on September 1, 2026, can allow someone with brief physical access to a locked device to view photos through the app’s in-call effects and Meta AI interface without unlocking the phone. The Android privacy bug is device-dependent: published testing reproduced it on a Pixel 6 Pro (Android 17) and an Oppo K13 (ColorOS 16), but not on a Samsung Galaxy S25 Ultra (One UI 8.5). iPhone is not affected through this reported path. WhatsApp posted on its official X account (@WhatsApp) that it was rolling out a fix; no specific patched version number had been confirmed in primary documentation at the time of writing. Until your device is confirmed patched, restricting WhatsApp’s photo access to limited or selected is the most straightforward available workaround.

Also Read: iQOO X:Specs & Feasibility Analysis

WhatsApp Lockscreen Vulnerability Frequently Asked Questions (FAQs)

Abhijeet Shrivastava

Author Bio
Abhijeet Shrivastava is a content writer at WriNews, where he covers smartphones, computers, laptops, electrical appliances, and a wide range of electronic and electrical components. With an academic background in Computer Science and additional knowledge and hands-on training in electrical systems and components, he brings both technical understanding and practical experience to his writing.

Alongside his work in content creation, Abhijeet serves as an assistant teacher at a school in Pune, combining his interest in technology with a passion for learning and education. He also runs his own workshop, where he regularly experiments with, repairs, and tinkers with electronic and electrical components. This hands-on experience helps him approach technology topics from both a practical and technical perspective.

Through his work, Abhijeet aims to make complex technology easier to understand while providing useful, accurate, and practical information for readers.