A new vulnerability in WhatsApp for Android has put the security community on alert. Researcher José RodrÃguez has demonstrated that it's possible to access photos stored on the device without unlocking it, simply by answering an incoming video call. The technique, which he shared on his account on the social network X, doesn't require the installation of any external applications or advanced technical knowledge.
The vulnerability exploits WhatsApp's video call interface when the phone is locked. When answering a call, the app provides access to a panel of effects and backgrounds where the 'Create with Meta AI' option is located. From there, after selecting the photo editing function, the system opens the device's entire gallery without requesting a PIN, password, or any biometric authentication method.
How does the exploit work and which devices are vulnerable?
The attack process is simple. The person with the phone must receive and accept a WhatsApp video call. Once connected, they tap the effects icon and access the backgrounds tab. There, they find the 'Create with Meta AI' option, which allows them to generate or edit images. When they choose to edit an existing photo, the app directly displays the gallery without any security verification.
Tests conducted by Notebookcheck confirm that this vulnerability does not affect all Android phones equally. In their tests, a Google Pixel 6 Pro running Android 17 with the latest security patch allowed users to view and scroll through images without being prompted for a passcode. They also managed to reproduce the flaw on an OPPO K13 with ColorOS 16. However, the Samsung Galaxy S25 Ultra with Android 16 and One UI 8.5 returned to the lock screen as soon as access to Meta AI was attempted, requiring the corresponding verification.
This disparity in behavior between devices using the same version of Android suggests that the problem is related to how each manufacturer customizes the permissions and features available when the phone is locked. Furthermore, iPhones are unaffected by this threat thanks to iOS's CallKit system, which displays Apple's native calling interface and does not allow full access to the WhatsApp interface without first unlocking the device.
Repercussions and provisional protection measures
Researcher José RodrÃguez has already informed both Meta and Google about this finding. However, no update has yet been released to permanently fix the problem. While awaiting an official patch, security experts recommend taking some additional precautions to reduce the risk of a third party accessing private photos.
One of the most effective measures is to limit WhatsApp's access permissions to the gallery . From Android settings, users can configure the app to only view a pre-selected subset of images, instead of having full access to the entire library. This option, found in the app permissions section, effectively negates the vulnerability.
It's important to note that this technique leaves no trace. It's not malware or a suspicious application; it's simply a video call that could easily go unnoticed by the victim. Therefore, anyone with physical access to the device and who knows the phone number could exploit the situation to spy on the stored images.
The news has generated significant concern among Android users, especially because the vulnerability can be exploited by people close to the user, such as family, friends, or coworkers. Although the attack requires having the phone in hand, the ease of the process and the lack of any warnings or restrictions during the call make it a risk worth considering.
The security community urges users to stay alert for WhatsApp updates and apply the recommended protective measures until a patched version is released. In the meantime, the best defense is to restrict access to the gallery and always keep the device's operating system updated with the latest security patches.
The impact of this flaw could be significant, considering the large number of users who use WhatsApp daily on their Android phones. The privacy of personal photos is compromised, and the consequences could range from the exposure of intimate memories to the malicious use of sensitive images.
Finally, this situation highlights the importance of responsibly investigating and reporting these types of vulnerabilities. Thanks to the work of researchers like José RodrÃguez and the coverage by specialized media outlets, users can learn about the risks and take steps to protect themselves before a major incident occurs. Collaboration between the security community and technology companies will be key to ensuring security and privacy within the Android ecosystem.