Your Locked Android Phone Will Hand Over Your Photos. All It Takes Is a WhatsApp Call.

A locked Android phone is supposed to be a closed box. That is the entire deal you make when you set a PIN or register a fingerprint: someone can pick up your handset, but they cannot get into your life. A security researcher has just demonstrated that on a number of popular Android phones, that box opens with nothing more than an incoming WhatsApp video call and about five taps.

No PIN. No pattern. No fingerprint. Straight into your camera roll.

The finding comes from Jose Rodriguez, a researcher with a long track record of poking holes in lock screens on both Android and iOS. He disclosed it to Meta and Google, then went public because, in his words, it is “a very visible security flaw, very easy to discover, and I am sure that it will be exploited right now.”

How five taps get past your lock screen

The chain is worth walking through slowly, because every individual step is a feature somebody deliberately shipped. Nothing here is a memory corruption bug or a clever exploit. It is a series of reasonable product decisions that nobody checked against each other.

It starts with the answer screen. When a WhatsApp video call arrives on a locked Android phone, you can swipe to answer without unlocking. That is intentional and, honestly, correct. Making people fumble with a fingerprint sensor before they can pick up a call would be a bad experience, and every phone platform makes the same call.

Once the call connects, WhatsApp draws its own in-call interface on top of the lock screen. That interface includes an effects button, the one that lets you slap a filter on your face or drop a fake background behind you. Tapping it opens a panel with tabs, and the panel defaults to filters.

Switch to the backgrounds tab and there is an option labelled “Create with Meta AI.” Choose it, then choose to edit an existing photo rather than generate a new one, and WhatsApp does exactly what any app does when it wants a picture: it opens the system photo picker.

Except your phone is still locked. And the picker is showing everything.

The prerequisite most coverage is skipping

There is a condition attached to this, and it matters. The gallery only opens because WhatsApp already holds broad permission to read your photos and videos. Almost everybody has granted that, because it is what happens the first time you try to send a picture in a chat and tap through the prompt.

Android has offered a middle setting for a while now. Instead of granting an app access to your entire library, you can grant it access to specific photos you pick, and it will ask again when it needs something new. Most people never touch it, because the full access option is the default path of least resistance and the consequences are invisible until a story like this one shows up.

This is the part that turns a scary headline into something you can act on in under a minute. The bypass still technically works after you change the setting. It just has nothing interesting to display.

It does not work on every phone, and the reason is interesting

Notebookcheck ran the sequence across several handsets and got different answers depending on the manufacturer. That inconsistency is the most revealing detail in the whole story.

Samsung’s One UI blocks it because Samsung applies its own rules about what an app may do from behind a lock screen, and pulling up a system picker did not clear the bar. Google’s own Pixel, running the newest version of Google’s own operating system with the newest patch, let it through.

Apple sidesteps the whole category for a structural reason rather than a defensive one. On iOS, a voice or video call from a third party app has to route through CallKit, which means you see Apple’s standard call interface rather than WhatsApp’s. There is no effects button on that screen because there is no WhatsApp screen. The feature that creates the hole simply cannot be reached.

You could argue that is Apple being restrictive at the expense of developers, and people have argued exactly that for a decade. This is what the other side of that trade looks like.

Lock screens keep failing in the same way

If this feels familiar, it should. Lock screen bypasses are one of the most persistent categories in mobile security, and they almost never involve breaking cryptography. They involve finding something the phone is willing to do before it knows who is holding it.

The lock screen is not a wall. It is a list of exceptions. Take a call. Show a notification preview. Open the camera. Reply to a message. Trigger the assistant. Every one of those exceptions is a small door, and every one of them was added because a product team correctly identified that users hate friction.

The failure mode is always the same: a door that was meant to lead one step forward turns out to lead five, because a feature added two years later attached itself to the far side. Nobody sat down and decided that a locked phone should surrender its photo library. Somebody added AI backgrounds to video calls, and the calls happened to be answerable while locked.

We saw a considerably worse version of this pattern earlier in the year, when researchers showed that a single video call could reach kernel level on millions of budget Android phones through a modem flaw. That one had no user fix at all. This one you can neutralize from the Settings app, which puts it in a much better category, even if the headline reads worse.

What Meta says

Meta has confirmed that a fix is rolling out, describing the issue as applying to a “very limited scenario.” Both halves of that are defensible. The attack does require somebody to physically hold your phone, which rules out remote mass exploitation. It also requires nothing else at all, which is not a comfortable thing to say about a device with a fingerprint sensor.

The more useful question is which side of the fix your device sits on. Client side fixes ship through app updates, so a WhatsApp update should close it for everyone eventually. But the underlying behavior, that a locked Android phone will let an app open a full system photo picker on request, is an operating system question rather than a WhatsApp question. Samsung answered it one way. Google answered it another way, on its own hardware.

Meta has been shipping a steady run of account security improvements lately, including the move that replaced WhatsApp’s six digit PIN with a real password and passkey support. Those changes are meaningful. They also protect a different thing entirely, which is your account rather than the device sitting on the table.

The practical read

Nobody needs to panic about this. The realistic threat model is not a nation state, it is a partner, a roommate, a colleague, or whoever picks up the phone you left face down at a bar. That is also, statistically, who actually goes through people’s photos.

Three things worth doing, in order of how much they buy you:

And if you are on a Pixel, note the awkward detail one more time: the device that failed this test was running the current release of Android with the current patch level. Being up to date is necessary. It has never been the same thing as being safe, and the gap between those two ideas is where the messy reality of Android’s update situation tends to live.

Thirty seconds in Settings. Go do it now, then come back and finish your coffee.