● Covered by 1 source · 1 reportMedium impact1 negative
WhatsApp for Android loophole allows photo access without device unlock
Key points
- WhatsApp for Android has a loophole allowing photo access without device unlock.
- The flaw is triggered by answering a WhatsApp call and using video filters.
- Pixel and Oppo devices are affected; Galaxy devices and iPhones are not.
- A temporary workaround involves limiting WhatsApp's photo access permissions.
Vulnerability Discovered in WhatsApp for Android
A loophole has been identified in WhatsApp for Android that permits unauthorized viewing of private photos on a locked device. This flaw was initially reported by @VBarraquito and confirmed by "Mobile Hacker" and NotebookCheck.
How the Loophole Works
The vulnerability is exploited by answering an incoming WhatsApp call on a locked device. During the call, accessing the video filters and effects, which include Meta's AI photo editing features, allows a user to preview photos without requiring the device to be unlocked with a PIN or biometrics.
Affected Devices and Limitations
This issue is not universal across all Android devices. NotebookCheck found that while Pixel and Oppo devices are susceptible, Galaxy devices enforce a lockscreen unlock before this step. iPhones are not affected as WhatsApp uses the native iOS calling interface. The loophole does not bypass the lockscreen entirely, meaning other device functions remain inaccessible, but it does allow for visual access to photos, which could be captured by a second device.
Mitigation and Reporting
WhatsApp is expected to release a patch for this vulnerability, though no update has been announced yet. The loophole has been reported to both WhatsApp and Google. As a temporary measure, users can set WhatsApp's photo/video access permissions to "limited" in Android settings to prevent exploitation of this flaw.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
A loophole in WhatsApp for Android allows private photos to be viewed on a device without it being unlocked, by answering a WhatsApp call and accessing video effects. This vulnerability affects Pixel and Oppo devices, but not Galaxy devices or iPhones, and has been reported to WhatsApp and Google.