WhatsApp Lock-Screen Bypass Hits Android Phones
WhatsApp Lock-Screen Bypass Hits Android Phones
Anonymous
Key Points
1
Device-specific test results show Pixel 6 Pro (Android 17) and Oppo K13 vulnerable to the lock-screen WhatsApp photo bypass, while Samsung Galaxy S25 Ultra on One UI blocked the bypass; iPhone remains unaffected due to Apple's CallKit integration.
2
Exploit steps: on a locked device receiving a WhatsApp video call, answer from the lock screen, tap the effects icon, switch to the Backgrounds tab, choose Create with Meta AI, then Edit photo to pull up the device's photo gallery without unlocking.
3
Root cause appears to be manufacturer-specific lock-screen implementations and permission handling, not a universal Android vulnerability; some OEM skins enforce authentication, others do not, leading to variability in whether the bypass works.
4
Status of response: researchers reported the flaw to Meta and Google; Meta is reportedly working on a fix but no official patch has been released yet and company responses have been limited.
5
Mitigation recommendations include restricting WhatsApp permissions or revoking camera access to break the bypass chain and prevent gallery access on locked devices.
A security flaw in WhatsApp for Android lets attackers view private photos on locked phones during video calls by accessing the gallery through call effects, Sangri Today reported. The bypass requires physical access to answer an incoming call and does not unlock the rest of the device, but it exposes photos that would normally stay hidden behind the lock screen.
The vulnerability affects some Android phones unevenly—Pixel 6 Pro and Oppo K13 devices tested positive, while Samsung Galaxy S25 Ultra with One UI blocked the bypass, according to iNews Zoombangla. iPhone users face no risk because Apple's CallKit integration prevents the same exploit path. Meta and Google have been alerted and are working on fixes, though no official patch has been released yet.
How the Bypass Works in Four Steps
The exploit chain starts simple: a locked Android phone receives a WhatsApp video call. The user answers from the lock screen—a feature WhatsApp allows without unlocking the device. Then they tap the effects icon during the call and navigate to the Backgrounds tab, Phandroid explained.
Next, they select Create with Meta AI, which prompts the phone to access the device's photo gallery. Instead of creating a new background, users tap Edit photo. This action exposes the full gallery view—completely bypassing the lock screen. The flaw only works if the caller has physical access to the phone.
Why Some Phones Are Vulnerable and Others Are Not
The root cause lies in how different phone manufacturers enforce lock-screen permissions. Android itself does not have a universal lock-screen protection layer. Instead, each OEM—Samsung, Google, Oppo—writes its own code to decide what apps can access during a locked state, Cyber Insider reported.
Samsung's One UI enforces stricter authentication checks before allowing gallery access. Pixel and Oppo skins apparently do not block the bypass at the same stage. This variance means some Android phones stay safe while others leak photos. Apple's iOS avoids this entirely by using CallKit, a system-level framework that sandboxes call UI permissions.
Meta and Google Race to Patch the Flaw
Researchers disclosed the vulnerability to Meta and Google weeks ago. Cyber Insider confirmed that WhatsApp has begun rolling out an emergency fix for the Android privacy issue. However, no official public patch date has been announced, and Meta's public responses have remained sparse.
The delay means millions of Android users remain exposed if they own a vulnerable device model. Google has been notified and is likely coordinating with device makers to push updates. Until a patch lands, users with Pixel or Oppo phones should take protective steps immediately.
Two Quick Fixes to Protect Your Photos Now
The simplest mitigation: revoke WhatsApp's camera permission in your phone's settings. Go to Settings > Apps > WhatsApp > Permissions and toggle Camera off. This breaks the bypass chain because the gallery cannot open without camera access granted.
A second option is to restrict WhatsApp's overall permissions to minimal levels. Some users have also disabled video call notifications on the lock screen entirely through WhatsApp settings. These workarounds take two minutes and add a security layer until Meta releases an official patch.
Sentiment
Mostly NegativeNEGATIVENEUTRALPOSITIVE
Publishers
12
Articles
7
Reach
19
Topics
A
AnonymousAuthor
