Affiliate links on Android Authority may earn us a commission. Learn more.
Sep 3, 2026 — 3:20 AM ET
- A WhatsApp privacy flaw can allow anyone to view your photos without unlocking your phone.
- The flaw lies in WhatsApp’s “create with AI” feature, which seems to bypass lock screen restrictions.
- It has already been reported to Meta and Google.
If you think your locked phone can prevent people from accessing your personal data, such as your photos, think again. A new flaw was recently discovered in WhatsApp that bypasses the usual lock screen restrictions and allows anyone to view all the photos saved in your phone’s gallery. The flaw was shared by Jose Rodriguez on X, explaining how it works and showing it in action (via NotebookCheck). When you receive a WhatsApp video call on your locked Android phone, you can answer it without unlocking the phone. That’s expected behavior—no surprises there.
Be aware that your photos can be accessed without unlocking your phone when you receive a WhatsApp video call on Android.
This is in plain sight. It’s not hidden, not a secret feature. Not a hack.
This has already been reported to Meta and Google.[#Privacy][#Security][#Android17][pic.twitter.com/F7wulhNiZ1]— Jose Rodriguez (@VBarraquito)[September 1, 2026] However, once the call connects, you can tap the effects icon to apply different filters and backgrounds to your video call. At this point, if you select the “Backgrounds” option and then tap the icon to create a background with Meta AI, WhatsApp lets you create a new image or edit an existing photo. Tapping the option to edit an existing photo seems to open the gallery immediately without unlocking the phone.
Fortunately, this privacy flaw doesn’t affect phones from all manufacturers. It appears to affect devices from OPPO and vivo, but Samsung phones don’t seem to be affected. The issue may stem from how a custom Android build handles lock screens and features accessible without unlocking the phone.
It’s also worth noting that this isn’t a vulnerability in the same way an exploit or a hack would be. This is simply Android manufacturers not handling lock screen restrictions properly. It can’t be done remotely either; a bad actor needs physical access to a device to exploit this flaw and access the gallery.
The flaw has already been reported to both Meta and Google, so a fix could be on the way.
Thank you for being part of our community. Read our Comment Policy before posting.