A loophole in WhatsApp for Android lets someone see private photos on your device without the device being unlocked, which obviously isn’t supposed to happen.

First spotted by @VBarraquito on Twitter/X and further confirmed by “Mobile Hacker” and NotebookCheck, a very straightforward flaw exists within WhatsApp for Android that allows someone to access a user’s private photos before the device is unlocked.

This works by first having a WhatsApp call pop up and be answered – this doesn’t require the phone to be unlocked, just like a standard phone call – at which point the user can tap a button to use filters and effects on their video feed, including Meta’s AI to edit a photo – you can see where this is going. Instead of preventing access to photos, the preview is shown clearly before the phone ever asks to be unlocked with a PIN or biometrics.

This isn’t universal, though. NotebookCheck found that a Galaxy device does force the lockscreen to be unlocked before reaching this step, while Pixel and Oppo devices both allowed the full bypass. The loophole doesn’t exist on iPhone, where WhatsApp is forced to use the native iOS calling UI.

The good news: this doesn’t seem to bypass the lockscreen fully, as accessing any other part of the device is still blocked. There’s also not much that can be done with the photos beyond physically seeing them – though a malicious party could use this to take photos of those images with a second device.

WhatsApp should be able to patch this with an update, but no such update has been announced at this time. The loophole has been reported to both WhatsApp and Google.

In the meantime, a temporary workaround is to set WhatsApp’s photo/video access to “limited” in Android’s permissions, which breaks the loophole.

• WhatsApp two-step verification codes are ditching six-digit PINs for full passwords
• WhatsApp updates group chats with new features including ‘@all’ tag
• Android Auto rolling out upgraded WhatsApp support

Follow Ben: Twitter/X, Threads, Bluesky, and Instagram

FTC: We use income earning auto affiliate links. More.