Overview
- Security researcher Jose Rodriguez demonstrated that accepting a WhatsApp video call and opening the effects/Meta AI menu can lead to an option that opens the phone’s photo gallery without unlocking the device.
- Meta has confirmed the issue and said it has started rolling a fix but tests show the update is not yet widely available and the flaw still works on several Android models.
- Not all phones are vulnerable because the problem depends on how each maker implements the Android lock screen, with some Pixel, Oppo, Sony, and Vivo models reproducible and many Samsung and iPhone models blocking the path.
- Exploitation requires physical access to the locked phone and currently appears limited to viewing images inside the gallery though an attacker could capture photos by photographing the screen with another device.
- Users should temporarily restrict WhatsApp’s photo permissions or avoid leaving locked devices unattended because revoking gallery access will stop in-app sending of stored images but reduces exposure until the patch is fully deployed.