A serious privacy flaw has been discovered in WhatsApp on Android phones that allows anyone to access your personal photos even when the device is locked. This issue was first spotted by @VBarraquito and subsequently confirmed by NotebookCheck. The flaw does not allow for remote hacking; instead, it requires physical access to the device. However, if someone has the phone in hand, they can bypass the lock screen using an incoming WhatsApp video call and open the photo gallery directly. This means personal photos can be viewed without a passcode, PIN, or fingerprint.

How does this WhatsApp flaw work?
Exploiting this method requires no specialized technical knowledge or hacking skills; it simply utilizes features already present within WhatsApp video calls. If a WhatsApp video call comes in on a locked Android phone, anyone holding the device can answer it. Once the call begins, tapping the 'effects' icon on the screen opens a menu offering options for effects, filters, and backgrounds. The user then needs to navigate to the 'backgrounds' section.

Here, the 'Create with Meta AI' option appears, allowing the user to generate a new image or edit an existing photo. Tapping 'Edit photo' immediately opens the phone's entire photo gallery, granting full access without unlocking the device.

NotebookCheck tested this on a Google Pixel 6 Pro running Android 17 with the latest security patch. The test revealed that personal photos stored on the phone could be easily viewed without any security verification.

It does not affect all Android phones
Fortunately, this flaw does not affect every Android smartphone. Whether or not it works depends largely on how the device manufacturer handles lock-screen permissions. NotebookCheck tested the same process on a Samsung Galaxy S25 Ultra running One UI 8.5. On that phone, tapping 'Create with Meta AI' immediately returned the user to the lock screen and prompted for passcode or fingerprint verification.

However, the trick worked on the Oppo K13 running ColorOS 16. Since both the tested Samsung and Oppo devices run on Android 16, this difference appears to stem from the companies' custom software rather than Android itself.

No impact on iPhones
According to the report, iPhone users are completely unaffected by this issue. Apple's CallKit framework utilizes the native iPhone calling interface for WhatsApp calls, ensuring that these in-call WhatsApp controls do not appear on the screen while the device is locked.

Disclaimer: This content has been sourced and edited from News18 Hindi. While we have made modifications for clarity and presentation, the original content belongs to its respective authors and website. We do not claim ownership of the content.