WhatsApp Android Bug May Let Someone View Private Photos Without Unlocking Your Phone
A newly reported WhatsApp privacy flaw on Android could allow someone holding a locked phone to access the device’s photo gallery through the video call interface. The issue does not involve a remote hack, malware, or advanced technical skills, but it still raises serious concerns for anyone who relies on the lock screen to protect personal photos.
The lock screen on a smartphone is designed to act as a clear security boundary. Even when certain actions are allowed, such as answering calls, viewing limited notifications, or checking the time, private files should remain protected until the owner unlocks the device with a PIN, password, fingerprint, or face scan. In this case, however, WhatsApp’s video call screen appears to create a path beyond that boundary on some Android phones.
The flaw reportedly works when a locked Android phone receives a WhatsApp video call. If someone has physical access to the device, they may be able to answer the call and interact with WhatsApp’s video effects and background tools. From there, the app can open options related to image editing, which may expose the phone’s gallery without asking for the usual unlock authentication.
This means the risk is limited to situations where another person can physically handle your phone. Someone cannot use this issue from across the internet to open your photo library. Still, the privacy concern is significant because a locked phone should never allow unrestricted access to personal images through a call screen.
Testing shows that the problem does not affect every Android device in the same way. Some phones correctly force the user back to the lock screen before allowing access to the gallery, while others appear to let WhatsApp reach stored images directly. This suggests the vulnerability may depend on how different Android manufacturers manage lock screen permissions and app behavior during calls.
For example, some Android software builds block the action properly by demanding a passcode or biometric unlock before the image gallery can be opened. Other Android skins may be more permissive, allowing WhatsApp’s background or photo-editing features to reach private media while the phone remains locked. Because Android brands often customize system behavior, the same app feature can produce different security results across devices.
Apple’s iPhone handles this type of situation differently. On iOS, WhatsApp calls on the lock screen are routed through Apple’s native call interface rather than giving full access to WhatsApp’s own in-call tools. This stricter separation helps prevent the app from opening image-related features before the device is unlocked. As a result, the same lock screen photo access issue is not expected to appear on iPhones.
The issue has reportedly been shared with both Meta and Google so it can be investigated and patched. Until an official fix arrives, Android users should be cautious about leaving their phones unattended, especially if WhatsApp video calls are enabled.
To reduce the risk, users should keep WhatsApp and Android system software fully updated, disable or limit lock screen notification previews if privacy is a concern, and avoid handing a locked phone to anyone they do not trust. If your phone allows app activity from incoming calls while locked, it may also be worth checking privacy and lock screen settings for stricter controls.
This WhatsApp Android bug is a reminder that privacy protection is not only about strong passwords or biometric security. Apps also need to respect the lock screen at every point, especially when they offer advanced features like filters, AI image tools, and background editing during calls. For users, the safest approach is to install updates as soon as they become available and treat a locked phone as something that still deserves physical protection.
