Your Android phone may be locked, but a newly discovered WhatsApp privacy flaw could still expose photos stored on some devices.

The issue involves WhatsApp video calls and the app’s Meta AI photo-editing feature. On affected Android phones, someone holding a locked device may be able to answer an incoming WhatsApp video call and reach the photo gallery without entering the owner’s PIN, password or biometric authentication.

The good news is that the WhatsApp privacy flaw does not affect every Android phone, and it cannot be exploited remotely through the reported method. An attacker would need physical access to your device.

The issue has already been reported to Meta and Google. However, Android users should understand which phones may be affected and what they can do while waiting for further updates.

What Is the WhatsApp Privacy Flaw?

Security researcher Jose Rodriguez recently highlighted an unusual privacy problem involving WhatsApp on Android.

Normally, locking your smartphone prevents another person from browsing private content such as your photos.

However, Android allows users to answer incoming calls without unlocking the device. That behaviour is normal and useful, but WhatsApp’s additional video-call controls can create an unexpected route to the photo gallery on some phones.

The reported issue involves WhatsApp’s video-call effects and Create with Meta AI photo-editing feature.

On affected devices, the phone does not request authentication before displaying the gallery.

As a result, someone who physically possesses the locked phone could potentially view personal images.

WhatsApp Privacy Flaw: What We Know

The differences between tested Android phones are particularly important. Users should not assume that either every Android device is vulnerable or every updated Android device is protected.

How the WhatsApp Android Lock-Screen Issue Happens

The privacy problem starts with an incoming WhatsApp video call.

Android normally lets users answer calls from the lock screen. After the WhatsApp video call begins, the app provides access to video effects, including backgrounds.

WhatsApp also integrates Meta AI into its image features. Meta’s own documentation confirms that WhatsApp can use Meta AI to create and edit images.

On an affected phone, accessing the photo-editing option from this call interface can cause the gallery to appear before Android requests authentication.

The important problem is therefore the missing authentication check between the locked call interface and photo selection.

This behaviour should not be confused with someone remotely hacking into a phone. The person needs the device in their hands and must interact with the call interface.

Which Android Phones Are Affected?

This is where the situation becomes more complicated.

Testing has produced different results across Android manufacturers.

NotebookCheck reproduced the issue on a Google Pixel 6 Pro running Android 17 with the latest security patch. The publication reported that the device allowed access to stored photos without requiring authentication.

The same behaviour was also reproduced on an Oppo K13 running ColorOS 16.

However, a Samsung Galaxy S25 Ultra running One UI 8.5 behaved differently. When the tester attempted to reach the Meta AI feature, Samsung returned the user to the lock screen and requested authentication.

That means the issue does not appear to affect Android devices universally.

Tested Device Results

Google Pixel 6 Pro: Gallery access was reproduced during testing.

Oppo K13: Testing also reproduced the problem.

Samsung Galaxy S25 Ultra: Samsung’s software blocked access and requested authentication.

These examples should not be treated as a complete compatibility list. Many Android models and software versions have not undergone public testing for this specific behaviour.

Why Samsung Phones May Behave Differently

The Samsung test provides an interesting clue.

Android manufacturers customise many parts of Google’s operating system. Samsung uses One UI, Oppo uses ColorOS, and Google Pixel devices run Google’s own version of Android.

These manufacturers can handle lock-screen permissions and app interactions differently.

In the Galaxy S25 Ultra test, Samsung correctly forced the user back to authentication when the Meta AI option attempted to access protected content.

That suggests the issue may involve the interaction between WhatsApp and individual Android lock-screen implementations, rather than one simple vulnerability affecting Android identically everywhere.

More investigation will be needed before the exact responsibility becomes clear.

Does the WhatsApp Privacy Flaw Affect iPhones?

The same method reportedly does not work on iPhones.

The reason involves the way iOS handles incoming WhatsApp calls.

Apple’s CallKit framework integrates WhatsApp calls with the native iPhone calling interface. Consequently, someone answering a WhatsApp call from a locked iPhone does not receive access to the same WhatsApp in-call controls used in the Android method.

That prevents the reported route to the Meta AI photo-editing option.

However, this does not mean iPhones can never experience WhatsApp security issues. It simply means the specific Android lock-screen photo problem discussed here does not currently reproduce on iOS through the same method.

Can Someone Exploit This WhatsApp Flaw Remotely?

No evidence currently suggests that someone can remotely browse your gallery using this reported method.

This distinction is important.

An attacker needs physical access to the locked Android phone.

Therefore, someone on the other side of the world cannot simply place a WhatsApp video call and start browsing your photos.

The greater concern involves situations where another person temporarily possesses your phone.

For example, the risk could become relevant if you:

• lose your phone
• leave it unattended
• lend it to another person while locked
• have your device stolen

The phone’s main interface remains locked during the reported behaviour. The issue specifically exposes access to photos through WhatsApp’s call and image-selection interface on affected devices.

Does This Mean WhatsApp Encryption Has Been Broken?

No.

The reported problem does not mean WhatsApp’s end-to-end encryption has been cracked.

End-to-end encryption protects messages and calls as they travel between users. This issue instead concerns local access to photos already stored on the smartphone.

Those are two different security layers.

The vulnerability therefore does not provide evidence that attackers can intercept encrypted WhatsApp messages or calls.

Meta AI Plays an Unexpected Role

Meta AI is becoming increasingly integrated into WhatsApp.

WhatsApp officially supports several AI-powered experiences, including creating images, editing photos and generating AI content.

Those capabilities require the app to interact with images stored on a user’s device.

Normally, Android’s security controls should prevent sensitive content from becoming available while the device remains locked.

In this case, however, the combination of an accessible video-call interface and Meta AI’s photo-editing option appears to create an unexpected path to the gallery on certain Android phones.

It demonstrates why adding powerful AI features to existing apps can introduce new privacy considerations.

How Android Users Can Protect Their Photos

Until Meta, Google or affected manufacturers provide clearer guidance or updates, concerned Android users can review WhatsApp’s photo permissions.

One practical precaution is to limit the photos and videos WhatsApp can access.

On many recent Android phones, you can do this through:

Settings → Apps → WhatsApp → Permissions → Photos and videos

If your phone provides a limited-access option, select only the photos you actually want WhatsApp to access rather than granting access to your entire gallery.

The exact menu wording can differ depending on your Android version and manufacturer.

Limiting photo access means WhatsApp cannot freely access every image stored on the device. However, it can also make sharing photos through WhatsApp less convenient.

Users should therefore choose the permission level that best balances privacy and usability.

Should You Disable WhatsApp Video Calls?

For most users, completely avoiding WhatsApp video calls would be an excessive response.

The reported issue requires another person to physically possess the phone. Moreover, testing suggests some Android implementations already block the behaviour correctly.

Instead, users who are concerned should focus on basic precautions:

Keep WhatsApp and Android updated, restrict unnecessary photo permissions, avoid leaving an unlocked or unattended phone with others, and install security updates as manufacturers release them.

You should also check for WhatsApp updates regularly while the issue remains under investigation.

Has Meta Fixed the WhatsApp Privacy Flaw?

As of the latest reports, the issue has been reported to both Meta and Google, but a broadly documented fix has not yet been announced.

That situation can change quickly.

A fix could potentially arrive through a WhatsApp update, Android security update or manufacturer-specific software update, depending on the underlying cause.

Android users should therefore keep both WhatsApp and their phone’s operating system updated.

Why This WhatsApp Privacy Issue Matters

The issue highlights an important smartphone security principle: a locked screen should prevent access to private content even when limited features remain available.

Calls, emergency functions and certain notifications often work while a smartphone remains locked. Apps must ensure that these permitted functions cannot become gateways to protected information.

In this case, a normal WhatsApp video-call feature appears to interact with an AI photo tool in a way that exposes the gallery on certain devices.

The fact that Samsung’s tested implementation blocks the behaviour also demonstrates how manufacturer-level security decisions can affect the outcome.

Should Android Users Be Worried?

There is reason to take the issue seriously, but there is no need to panic.

Current evidence indicates several important limitations.

The person attempting to view the photos needs physical access to the phone. The reported route does not unlock the entire device. Furthermore, testing shows that some Android phones already prevent access.

The best response is therefore straightforward: keep your software updated and review WhatsApp’s photo permissions if privacy is particularly important to you.

Users with affected devices can also reduce their exposure by limiting WhatsApp’s access to their complete photo library while waiting for further information.

What Happens Next?

Meta and Google have reportedly received details about the issue, so attention will now turn towards a fix.

Several possibilities exist.

WhatsApp could change its video-call interface and require users to authenticate before accessing Meta AI photo editing on a locked phone. Google could adjust Android’s handling of protected content, or individual manufacturers could strengthen their own lock-screen restrictions.

The final solution may depend on exactly where developers identify the underlying problem.

Mobile Verse will continue watching for an official WhatsApp, Meta or Android update addressing the issue.

What Mobile Verse Readers Should Know

The newly reported WhatsApp privacy flaw is unusual because it does not rely on malware, stolen passwords or sophisticated hacking tools.

Instead, it appears to take advantage of features that normally work as intended: answering a video call from the lock screen and accessing WhatsApp’s AI-powered photo tools.

On certain Android phones, those two functions can interact in a way that exposes photos without authentication.

However, the risk has clear limits. An attacker needs physical access, not all Android phones reproduce the issue, and the same route does not currently affect iPhones.

For now, Android users should keep WhatsApp updated, review photo permissions and watch for official security updates from Meta, Google and their phone manufacturer.

Frequently Asked Questions

What is the WhatsApp privacy flaw?

The WhatsApp privacy flaw can allow someone holding certain locked Android phones to reach stored photos through WhatsApp’s video-call and Meta AI features without first completing normal authentication.

Can someone remotely access my photos through WhatsApp?

Current reports do not show a remote attack. Someone needs physical access to the affected Android phone to reproduce the reported behaviour.

Does the WhatsApp privacy flaw affect every Android phone?

No. Tests reproduced the issue on a Pixel 6 Pro and Oppo K13, while a Galaxy S25 Ultra blocked the attempt and requested authentication.

Does this WhatsApp issue affect Samsung phones?

Testing on a Galaxy S25 Ultra running One UI 8.5 blocked the reported method. However, that single result does not guarantee that every Samsung model and software version behaves identically.

Does the WhatsApp photo flaw affect iPhones?

The reported method does not reproduce on iPhones because iOS handles WhatsApp calls through Apple’s native calling interface.

How can I protect my WhatsApp photos?

Keep WhatsApp and Android updated and consider limiting WhatsApp’s photo and video permissions through Android Settings. Giving WhatsApp access only to selected photos can reduce the amount of gallery content available to the app.

Smartphone security depends on both apps and the operating system protecting sensitive information correctly. Mobile Verse readers can also explore our latest Android 17 updates and security coverage and our recent iOS 27 iPhone Handoff guide to learn how new mobile software features are changing privacy, connectivity, and everyday smartphone use.