A security breach WhatsApp for Android allows you to access photos stored on some phones without having to unlock them. The problem was announced this Tuesday by the security researcher Jose Rodriguezwho has published a video on X with the entire procedure and assures that it has already been communicated to Goal and Googlereports Notebookcheck.
The failure does not allow remote access to the photographs of any WhatsApp user. The person needs physically have the cell phone locked in your hands and receive a video call through WhatsApp at that moment. The problem appears because it is possible answer the call without unlocking the phone and, from the application interface itself, access a function that has access to stored images.
The procedure shown by Rodríguez is very simple and does not require installing applications, using external tools or having any special technical knowledge. After answering the video call with the phone locked, you must Press the effects icon and access the backgrounds tab. Within this menu the option appears ‘Create with Meta AI’which allows generating a new image or edit an existing photo.
By selecting this last option, the affected mobile phones directly open the gallery without requiring PIN, password, fingerprint or facial recognition. In this way, a person who has the device in their hands You can check the photos even if the phone is still locked.
Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android.
This is in plain sight. It’s not hidden, not a secret feature. Not a hack.
This has already been reported to Meta and Google.#Privacy #Security #Android17 pic.twitter.com/F7wulhNiZ1— Jose Rodriguez (@VBarraquito) September 1, 2026
The tests carried out by Notebookcheck They show that the problem does not affect all Android phones. The medium managed to reproduce it in a Google Pixel 6 Pro with Android 17 and the latest security patch availablewhere he was able to browse the images without passing any checks. Access also worked in a Oppo K13 with ColorOS 16.
However, the same procedure did not work in a Samsung Galaxy S25 Ultra with Android 16 and One UI 8.5. When you try to access Meta AI from the video call, your phone showed the lock screen again and demanded to enter the code or use biometric identification. That Oppo and Samsung use Android 16 but respond differently indicates that the behavior also depends How each manufacturer manages the permissions available from the lock screen.
The iPhone are also not affected due to CallKitthe system you use iOS to manage calls from applications like WhatsApp. When the phone is lockedCallKit displays Apple’s native calling interface instead of allowing full access to the WhatsApp interface. This prevents you from reaching the background tool and requires you to unlock the device before accessing the gallery.