Illustration of WhatsApp’s Android video-call interface exposing the photo gallery from a locked phone on some devices.
A WhatsApp video call on a locked Android phone can expose the device’s photo gallery through WhatsApp’s effects and Meta AI photo-editing path before the lock screen fully cuts off access. The issue needs physical access to the phone and does not remotely unlock the device or amount to a full lock-screen bypass. In testing, NotebookCheck reproduced the behavior on a Pixel 6 Pro running Android 17 and an Oppo K13 running ColorOS 16, while a Galaxy S25 Ultra on One UI 8.5 forced authentication first and blocked the same route. No patch has been announced yet, and the current stopgap is to limit WhatsApp’s photo and video permissions on Android.
The WhatsApp video-call path that reaches a locked Android gallery
The exposed path starts inside WhatsApp’s own video-call interface on Android. During an incoming or answered video call on a locked phone, the app can surface its effects tools and the Meta AI photo-editing flow, and that route can reach the local gallery before the lock screen fully reasserts itself. In practice, that means someone holding the phone may be able to browse private images without first authenticating through the normal unlock screen.
That is narrower than a full device compromise, but it is still a meaningful privacy problem. The phone is not broadly unlocked, and this is not a remote attack coming in over the internet. The risk is local exposure: if a work phone, field device, or shared customer-service handset is briefly out of the owner’s control, photos may be visible through WhatsApp’s call UI even while the device remains locked.
Pixel and Oppo tests exposed the bypass, Samsung forced authentication
The tested scope matters here because the behavior is not uniform across Android. NotebookCheck reproduced the gallery exposure on a Pixel 6 Pro running Android 17 and on an Oppo K13 running ColorOS 16. On both devices, the WhatsApp call flow allowed the path into gallery access before a normal unlock step blocked it.
Samsung’s result went the other way. On a Galaxy S25 Ultra running One UI 8.5, the same route hit the lock screen and required authentication before the gallery could open. That split makes this an implementation-dependent issue rather than a blanket Android flaw, and it is the main reason users should avoid assuming that every device is either vulnerable or protected.
There is also a platform boundary to keep in mind. iPhones are not affected because WhatsApp calls on iOS run through Apple’s native CallKit interface rather than WhatsApp’s full custom call UI. That difference appears to remove the same gallery-access path from the lock-screen call flow.
No patch yet, but Android permissions can blunt the exposure
There is no announced fix or patch from Meta or Google yet. For now, the practical step for Android users is to change WhatsApp’s photo and video access to limited permissions instead of broader gallery access. That setting is said to stop the bypass, but it should be treated as a stopgap rather than a confirmed permanent fix across every Android build.
For teams using WhatsApp on operational phones, the immediate takeaway is straightforward: this is a physical-access privacy issue, not a network breach, and it is most relevant on shared or frequently handled Android devices. If those phones are used for customer chats, field work, or shift-based handoffs, tightening WhatsApp media permissions is the fastest way to reduce exposure while the scope across Android devices remains uneven.
Disclaimer: This article was created with the assistance of AI. Images are for illustrative purposes only.
About the author
Samarth Agrawal is an AI and technology professional who writes about WhatsApp, automation, and emerging AI trends. He focuses on simplifying complex tech updates into practical insights for businesses, creators, and everyday users
