WhatsApp security flaw allows access to private photos on locked Android devices

A security vulnerability has been discovered in WhatsApp for Android that allows unauthorized access to private photos even when the device is locked. The flaw was identified by security researcher José Rodríguez.

The issue stems from a flow error within the application. Users can answer video calls directly from the lock screen, which grants access to certain interface tools without requiring a PIN or biometric authentication. By accepting a call and navigating through the effects menu to the background section, users can select the ‘Create with Meta AI’ option. This tool includes a function to edit existing images on the device, which triggers the system to open the full photo gallery without requesting a password or facial recognition.

The impact of this vulnerability varies depending on how specific device manufacturers manage app permissions on Android.