It sounds like something out of a spy movie, but it's a rather unsettling reality for Android users. There's been outrage following the discovery of a security vulnerability in WhatsApp that leaves the door open for anyone with curiosity (or malicious intent) to peek at our private photos, even if the phone is locked with a passcode.
The most surprising thing is that we're not talking about a complex hack with strange code or secretly installed malware. We're dealing with a workflow error in the application that allows users to bypass the PIN or fingerprint security through a series of very simple steps that anyone could repeat if they have the phone in their hands.
What exactly does this security flaw consist of?
The problem was brought to light by security researcher José RodrÃguez, known on social media as @VBarraquito. What happens is that WhatsApp allows users to answer video calls directly from the lock screen . Once the call is established, the user has access to certain app interface tools without having to formally unlock the device.
Accessing the photos is surprisingly straightforward: after accepting the call, simply go to the effects menu, navigate to the backgrounds section, and select the 'Create with Meta AI' option . Within this tool, which you can compare to other options in our Meta AI comparison for WhatsApp , there's a function for editing existing images on your device. Tapping it opens the entire gallery without requiring a password or facial recognition, allowing you to browse all your stored images.
Who is in danger and who is safe?
This is where things get interesting, because the flaw doesn't affect everyone equally. It's not a general Android problem; rather, it depends on how each brand manages permissions and the security of its custom interface when the phone is locked.
- Vulnerable devices: The problem has been confirmed to occur on the Google Pixel 6 Pro (even with Android 17 and recent patches) and on the OPPO K13 with ColorOS 16.
- Protected devices: In the case of Samsung, specifically on the Galaxy S25 Ultra with One UI 8.5, the system reacts correctly, returning the user to the lock screen and requiring authentication before allowing access to Meta AI.
- The Apple case: iPhone users can breathe a sigh of relief. This is because iOS uses CallKit for managing callsThis forces the use of Apple's native interface and blocks access to WhatsApp's internal tools until the phone is unlocked.
Real risks and how to avoid them happening to you
It's crucial to understand that this isn't a remote attack. No one can access your photos from the other side of the world; for this to work, the attacker needs physical access to your phone and your number to initiate a video call. This risk is more likely in close-knit environments, such as with acquaintances or coworkers who have access to your device when you're not looking.
The most dangerous aspect is that this action leaves no trace . There are no records of installed applications or security alerts; to the victim, it simply appears that someone tried to make a video call. Since Meta and Google have already been notified but there is no official patch yet available, there is a way to neutralize the risk manually.
The most effective temporary solution is to go to your Android permissions settings, find WhatsApp, and change the photo and video access to "Allow limited access ." This way, the app will only be able to see the images you've previously selected, rendering Meta AI's access to your entire gallery completely useless.
This incident reminds us that absolute security doesn't exist and that sometimes a simple oversight in the interface can compromise our privacy. While we wait for the official Meta update that will close this vulnerability, the wisest course of action is to keep your phone out of reach of third parties and adjust gallery permissions for greater peace of mind.
