WhatsApp appears to have a privacy flaw on Android phones that can let someone access private photos even when the phone is locked. The issue was first spotted by @VBarraquito on X and later confirmed by NotebookCheck. The flaw does not allow someone to remotely access a phone. They need to have physical access to the device. However, once they have the phone, they may be able to use an incoming WhatsApp video call to get past the lock screen and open the phone’s photo gallery. This means personal photos could be viewed without entering a passcode, PIN or using biometric authentication.
The process does not require any special technical knowledge. It uses options that are already available inside a WhatsApp video call. If a locked Android phone receives a WhatsApp video call, the person holding the phone can swipe to answer the call. Once the call starts, they can tap the effects icon, which will open a menu with different options, including effects, filters and backgrounds. The user then has to move to the background section.
Also read: OpenAI faces 30 more lawsuits over school shooting incident, accused of aiding and abetting attack
Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android.
— Jose Rodriguez (@VBarraquito) September 1, 2026
This is in plain sight. It's not hidden, not a secret feature. Not a hack.
This has already been reported to Meta and Google.#Privacy #Security #Android17 pic.twitter.com/F7wulhNiZ1
Now, the person has to tap the ‘Create with Meta AI’ option, which shows options to create a new image or edit an existing photo. Selecting Edit photo can open the phone’s photo gallery. The gallery can be accessed without first unlocking the phone.
NotebookCheck tested the issue on a Google Pixel 6 Pro running Android 17 with the latest security patch. The test showed that personal photos stored on the device could be browsed without any security check.
Also read: OpenAI works on automated shutdown feature after AI agent hacked Hugging Face: Report
The flaw does not appear to work on every Android smartphone. The way manufacturers handle lock-screen permissions seems to play an important role.
NotebookCheck tested the same process on a Samsung Galaxy S25 Ultra running One UI 8.5. On that phone, tapping ‘Create with Meta AI’ took the user back to the lock screen and asked for a passcode or biometric authentication.
However, the same method reportedly worked on an Oppo K13 running ColorOS 16. Since both Samsung and Oppo devices tested run Android 16, the difference appears to be linked to the manufacturers’ software rather than Android alone.
The issue reportedly does not affect iPhones. Apple’s CallKit framework uses the native iPhone calling interface for WhatsApp calls, preventing the same WhatsApp controls from appearing while the device is locked.