A newly discovered WhatsApp for Android loophole can expose your private photos to anyone holding your phone, even when the device is locked. The flaw sidesteps the usual security prompts and shows image previews without requiring a PIN or biometric unlock.
How the WhatsApp Loophole Works
The issue starts with an incoming WhatsApp call, which can be answered without unlocking the phone, much like a standard phone call. Once the call is active, a user can tap a button to apply filters and effects to the video feed, including Meta’s AI photo-editing tools. Reaching for that feature surfaces a preview of the device’s photo library, displaying the images clearly before the phone ever asks for a PIN or biometric verification.
The behavior is not universal across Android hardware. Testing showed that a Samsung Galaxy device forced the lockscreen to be unlocked before reaching this step, blocking the exploit. Google Pixel and Oppo devices, however, both allowed the full bypass. The loophole does not exist on iPhone, where WhatsApp is required to use the native iOS calling interface.
What Attackers Can and Cannot Do
The good news is that the flaw does not fully break through the lockscreen. Access to other parts of the device remains blocked, and there is little a malicious party can do with the photos beyond physically viewing them. Still, someone could use a second device to photograph the images shown on screen, creating a real privacy risk for anyone who leaves their phone unattended.
The flaw has been reported to both WhatsApp and Google. A software update should be able to close the gap, but no such patch has been announced at this time.
How to Protect Your Photos Now
Until a fix arrives, there is a straightforward workaround. Setting WhatsApp’s photo and video access to “limited” within Android’s permissions breaks the loophole and prevents the previews from appearing on the lockscreen. Users can adjust this setting through the app permissions menu on their Android device.
The vulnerability was first spotted publicly and later confirmed by multiple security-focused sources, all of whom reproduced the behavior on affected hardware. The exploit depends entirely on WhatsApp’s in-app calling interface, which is why devices that force a native lockscreen check are not affected in the same way.
Source
Image: 9to5google.com
