Whether a stranger can browse your photos on your locked Android phone through WhatsApp appears to come down to who made the phone. NotebookCheck tested the same sequence on three handsets and got three different outcomes. A Pixel 6 Pro on Android 17 with the latest security patch handed over the full gallery. So did an Oppo K13 running ColorOS 16. A Galaxy S25 Ultra on One UI 8.5 threw up the lock screen and demanded a PIN or biometric scan instead.
The Oppo and the Samsung both run Android 16 underneath. That is the detail worth sitting with. The gap is not a version gap, it is a difference in how each manufacturer’s skin decides what an app is allowed to do above the lock screen.
How the WhatsApp lock screen photo access works
The route in is an incoming WhatsApp video call, which a locked Android phone lets anyone answer with a swipe, exactly like a normal call. Once the call connects, the effects icon opens a panel with filters, effects and backgrounds. In the backgrounds section sits a “Create with Meta AI” button, and behind that an “Edit photo” option. On an affected phone, choosing it opens the device’s photo gallery with no unlock prompt at any point.
There is no exploit code here and no remote attack. Someone has to be holding your phone. That bounds the damage, and both outlets covering the finding say the rest of the device stays locked. It is still a real problem. Anyone who picks up a lost or briefly unattended phone can page through your photos, and can photograph what they see with a second device.
iPhones are not affected. Apple forces WhatsApp calls through the CallKit framework, so a locked iPhone shows Apple’s own call interface rather than WhatsApp’s, and the effects panel is never reachable.
What you can do right now
The workaround is a permission change, and it takes a few seconds. In Android’s app permission settings, set WhatsApp’s Photos and videos permission to limited or selected access instead of full access. The exact menu route and wording vary by manufacturer, which is the same reason the flaw itself behaves differently across brands. Once it is set, WhatsApp only sees the images you explicitly pick, so the gallery that opens from the call screen has nothing in it worth seeing.
This is the kind of hole that gets created by an app insisting on its own call UI. WhatsApp keeps its effects panel, and now its Meta AI image tools, one tap deep on a screen the OS shows before you authenticate. The more surface an app bolts onto that screen, the more ways there are to walk through it. As of September 3, no statement from Meta or Google has surfaced, and 9to5Google notes that no fix has been announced.
The behaviour was first flagged by security researcher Jose Rodriguez (@VBarraquito) on X and reported to both Meta and Google. If you have already tightened up your account after WhatsApp replaced its six-digit PIN with a full password, this permission toggle is the natural next step.
Sources: Jose Rodriguez (@VBarraquito), via NotebookCheck and 9to5Google
