A loophole in WhatsApp for Android lets someone see private photos on your device without the device being unlocked, which obviously isn’t supposed to happen.
First spotted by @VBarraquito on Twitter/X and further confirmed by “Mobile Hacker” and NotebookCheck, a very straightforward flaw exists within WhatsApp for Android that allows someone to access a user’s private photos before the device is unlocked.
This works by first having a WhatsApp call pop up and be answered – this doesn’t require the phone to be unlocked, just like a standard phone call – at which point the user can tap a button to use filters and effects on their video feed, including Meta’s AI to edit a photo – you can see where this is going. Instead of preventing access to photos, the preview is shown clearly before the phone ever asks to be unlocked with a PIN or biometrics.
This isn’t universal, though. NotebookCheck found that a Galaxy device does force the lockscreen to be unlocked before reaching this step, while Pixel and Oppo devices both allowed the full bypass. The loophole doesn’t exist on iPhone, where WhatsApp is forced to use the native iOS calling UI.
The plastic piece here has nothing to do with the exploit, and is presumably only for covering a contact name
