In short: On 3 September 2026, researchers documented a flaw in WhatsApp for Android that allows anyone holding a locked smartphone to browse private gallery photos — no PIN, no fingerprint required. The exploit uses an incoming WhatsApp video call combined with the Meta AI photo-editing feature. No official patch or CVE has been issued as of 8 September 2026; WhatsApp and Google have been notified.
How the exploit works: video call as a bypass
The exploit requires no technical skill. The sequence was first described by user VBarraquito on X (formerly Twitter) and subsequently confirmed by several independent researchers and publications:
- An attacker (or anyone physically holding the phone) initiates a WhatsApp video call to the target device.
- The call is answered from the locked screen — Android permits this without requiring a PIN or biometric unlock.
- Once in the video call interface, the effects and filters icon is tapped.
- The Meta AI photo-editing function is selected from the menu.
- The application displays thumbnail previews of gallery photos before requesting any PIN or fingerprint authentication.
The root cause is that WhatsApp holds a gallery access permission granted at install time, but the Meta AI integration did not account for the scenario where media content would be accessible before the user authenticates. Our privacy blog covers how apps request and use permissions, and why the principle of least privilege matters for everyday security.
Which devices are affected
Based on independent testing reported across multiple outlets:
- Google Pixel and Oppo devices — vulnerability confirmed: gallery photos are viewable without unlocking the screen.
- Samsung Galaxy — on tested models the system requires an additional unlock step before showing gallery content in this scenario; vulnerability does not reproduce.
- iPhone (iOS) — not affected: WhatsApp on iOS uses Apple's system permission layer, which does not allow media access prior to authentication.
A definitive list of affected models is still being compiled. As of the publication date (8 September 2026), no official statement has been issued by WhatsApp. If your device runs Android, treat it as potentially vulnerable until a patch arrives. A similar class of vulnerability — where an application relaxes protections in trusted interaction scenarios — was documented earlier in research on AirDrop and Quick Share privacy loopholes.
What an attacker can actually access
The flaw exposes photo thumbnails from the gallery. Available reports indicate that with additional steps a full-size image view and screenshots are also achievable. Access to other system areas — apps, contacts, file system — remains locked; full device takeover is not possible through this path.
Nevertheless, the photo gallery frequently contains the most sensitive content: screenshots of passwords and documents, personal photographs, and images of payment cards or receipts. For scenarios involving physical proximity — theft, a borrowed phone, domestic surveillance — this is a highly practical attack vector.
How to protect yourself before a patch arrives
- Revoke WhatsApp gallery access. Go to Settings → Apps → WhatsApp → Permissions → Photos & Videos and set it to Denied or Only while using. This closes the vulnerability, but you will need to use the system picker to share photos within the app.
- Monitor WhatsApp updates on Google Play and install them immediately once a patch is released.
- Avoid leaving your phone unattended in environments where someone could answer an incoming call.
For additional protection of your data over public networks, LiMP VPN's privacy features encrypt your connection end-to-end — even if your device is connected to an untrusted access point, your traffic stays private.
Why this matters beyond the obvious
The lock screen is widely treated as the primary line of physical device security. Vulnerabilities that partially bypass it carry outsized risk for several reasons:
- Trust in a familiar app. Users do not expect this from an official messenger and do not apply preventive measures such as revoking permissions.
- Physical access is a common threat model. Theft, a borrowed phone, an opportunistic coworker — none of these require any technical tools to exploit this flaw.
- No visible trace. Browsing gallery previews through the WhatsApp UI does not create entries in the standard Android system logs accessible to the device owner.