WhatsApp security flaw allows access to private photos on locked Android devices

A security vulnerability in WhatsApp for Android has been discovered that potentially allows unauthorized access to a user's private photo gallery on a locked device. The flaw, identified by security researcher Jose Rodriguez, involves using a video call to bypass the system's display lock.

According to reports, an attacker with physical access to a locked Android device can initiate a WhatsApp video call. Once the call is answered, the user can access the media gallery through the video effects or Meta AI 'Create with AI' menus. While users cannot send or open specific files through this view, they can see thumbnails of private photos, which could be photographed by an external camera.

The vulnerability appears to affect specific Android devices, such as Google Pixel and Oppo, but was not reproducible on Samsung Galaxy devices, where the system still requires unlocking to access the gallery. iPhone users are unaffected as WhatsApp uses native iOS interfaces for calls. Meta has reportedly released a patch to address the issue, and users are advised to update their WhatsApp application immediately.