A WhatsApp for Android privacy flaw can expose photos stored on a locked phone without requiring the device’s PIN, password or biometric authentication, creating an awkward gap between Android’s lock screen protections and features available during WhatsApp calls.
The issue does not provide unrestricted access to the phone, but it can allow someone with physical access to the device to view images that would normally remain protected behind the lock screen. The flaw has been demonstrated on some Pixel and Oppo phones, although testing suggests it does not affect every Android device in the same way.
The problem starts with WhatsApp’s incoming call interface. Like conventional phone calls, a WhatsApp call can be answered while an Android device remains locked. During the call, WhatsApp provides access to video effects and filters, including a Meta AI feature capable of editing photos.
That is where the privacy boundary breaks down. Selecting the photo-editing option can display images from the device before Android requests authentication, effectively exposing the photo library through a feature that remains accessible from the locked call interface.
Importantly, this is not equivalent to completely bypassing Android’s lock screen. Other parts of the phone remain inaccessible, and the person holding the device appears limited in what they can actually do with the exposed photographs. But simply being able to view private images is a meaningful privacy problem, particularly because someone could photograph the screen using another device.
The behaviour also appears to vary between manufacturers. Testing cited in reports found the bypass working on Pixel and Oppo hardware, while a Samsung Galaxy device required the phone to be unlocked before allowing access to the relevant feature. WhatsApp on iPhone is reportedly unaffected because calls use Apple’s native iOS calling interface rather than exposing the same path through WhatsApp.
The inconsistency is particularly interesting because it illustrates how security behaviour on Android can depend on the interaction between an app, Android itself and manufacturer-specific implementations. A feature that behaves safely on one device may unexpectedly expose information on another.
Both WhatsApp and Google have reportedly been notified about the issue, but no update specifically addressing the loophole had been announced at the time of reporting.
There is a temporary mitigation for concerned Android users. Changing WhatsApp’s photo and video permission to limited access reportedly prevents the bypass from working. That naturally restricts which images WhatsApp can access, but it is a reasonable compromise until a proper fix arrives.
The flaw is not the sort of lock-screen exploit that hands an attacker unrestricted control of a smartphone, so there is little reason for panic. It is still a privacy failure that should not exist: if a phone is locked, an app feature available from an incoming call should not provide a side door into photographs the lock screen is supposed to protect.
