Overview
- Researchers found that after a locked Android phone answers a WhatsApp video call a user can tap the effects or Meta AI option, choose Edit Photo, and open the full photo gallery without entering a PIN or biometrics.
- The flaw only appears on some Android phones and depends on each maker’s lock‑screen rules, with Pixel and several Oppo devices reproducing the bypass while at least one Samsung Galaxy test blocked it.
- The bug lets someone view or photograph images but does not grant full device access or remote control, and it requires physical possession of the phone during an answered call.
- The issue has been reported to WhatsApp (Meta) and Google and remains unpatched, and security outlets advise setting WhatsApp’s media permission to limited or disabling lock‑screen/video‑call previews as temporary workarounds.
- Apple iPhones are not affected because iOS routes third‑party calls through CallKit, and the variability across Android vendors means the fastest fix could come from an app update that requires unlock before opening in‑call editing tools.