September 3, 2026, 2:55 pm | Read time: 2 minutes

A locked smartphone is supposed to prevent strangers from accessing personal content. However, a vulnerability in WhatsApp described by “Futurezone.at” shows that this protection can apparently be bypassed on some Android devices. The smartphone’s photo gallery is affected, where private pictures, documents, or screenshots are often stored.

Also of interest: New WhatsApp feature soon to remind of unsent messages

Particularly concerning is that, according to reports, neither special software nor extensive technical knowledge is required. The security flaw is said to be exploitable solely through functions within WhatsApp. The issue has since been reported to both Meta and Google.

How the Security Flaw Works

The starting point is a video call via WhatsApp on a locked Android smartphone. If the call is accepted, a menu with filters and backgrounds can be opened through the effects function. There, the option “Create with Meta AI” leads to further options within the app.

If “Edit photo” is then selected, the smartphone’s photo library can open. In documented cases, the system did not request the device code or a fingerprint. This flaw bypasses the actual lock screen protection.

Not Every Android Smartphone Affected

However, the flaw does not seem to occur on all devices. According to its own reports, “Futurezone” was able to replicate the process on a Sony Xperia 5 with Android 15. The Samsung Galaxy Z Fold 8 required additional authentication before access.

Also, on a Pixel 11 Pro XL with Android 17, the video call could not be accepted while the device was locked, according to the report. Apple’s iPhones are said not to be affected by the issue. Until a corresponding update is available, access to photos and videos from WhatsApp can be disabled in the Android settings. However, this also means that pictures or videos can no longer be sent directly via the messenger.