A newly discovered WhatsApp privacy flaw is allowing unauthorized users to bypass Android lock screens and view personal photo galleries in plain sight. By exploiting a loophole in the app's Meta AI background feature during video calls, anyone with physical access to certain Android devices can browse your private images without needing a passcode.
Security researcher Jose Rodriguez demonstrated the vulnerability on X, revealing that the exploit requires no specialized hacking tools. When a user receives a WhatsApp video call on a locked device, they can answer it normally. However, tapping the effects icon and navigating to the background settings exposes a critical security gap.
How the Lock Screen Bypass Works
Because this vulnerability requires physical access to your device, understanding how it is triggered can help you stay vigilant until an official patch is released. The exploit follows these exact steps:
- Answer an incoming WhatsApp video call on a locked phone.
- Tap the effects icon to access video filters.
- Select the Backgrounds option.
- Tap the icon to create a background using Meta AI.
- Choose the option to edit an existing photo, which immediately opens the device's full gallery without a prompt for authentication.
Fortunately, this vulnerability does not impact all Android smartphones. Testing indicates that the issue primarily affects devices from OPPO and vivo, likely due to how their custom Android interfaces handle lock screen permissions. Samsung Galaxy devices appear to be immune to this specific bypass.
Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android. This is in plain sight. It's not hidden, not a secret feature. Not a hack.
- Jose Rodriguez, Security Researcher
Because the flaw requires physical access to the phone, remote exploitation is impossible. Both Meta and Google have been notified of the issue, and a security patch is expected to roll out soon to address the oversight in how custom Android builds handle lock screen restrictions.
The Hidden Cost of Rushed AI Features
This vulnerability perfectly illustrates the friction between rapid AI deployment and fundamental operating system security. Meta’s rush to integrate generative AI into every corner of WhatsApp - including video call backgrounds - created an unintended backdoor because the AI interface wasn't properly sandboxed by custom Android skins like ColorOS and Funtouch OS.
While a fix is imminent, this incident serves as a warning for Android OEMs. When third-party apps are granted deep system access to power new AI tools, the traditional lock screen is no longer the impenetrable wall it used to be. Users should remain cautious about leaving their devices unattended, as software complexity continues to introduce unexpected physical security risks.
