Technology
WhatsApp for Android flaw allows photo viewing from locked screens on some devices
A bug triggered during video calls exposes stored images without requiring a PIN on certain Android phones.
The short version
- A loophole in WhatsApp for Android lets individuals view stored device photos without unlocking the phone during an incoming call.
- The vulnerability affects certain Android models like Google Pixel and Oppo, while Samsung Galaxy and iOS devices are reportedly not susceptible.
- WhatsApp and Google have received reports about the flaw, but an official software patch has not yet been released.
- Users can mitigate the issue by restricting WhatsApp's photo and video permissions in Android settings.
Key facts
- The vulnerability is activated by answering an incoming WhatsApp call on a locked device and opening the video filters and effects menu.[9to5Google]
- The flaw displays photo previews without prompting for PIN or biometric authentication, though it does not provide broader access to the operating system.[9to5Google]
- Testing by NotebookCheck confirmed the bypass on Pixel and Oppo handsets, whereas a tested Galaxy phone required authentication.[9to5Google]
- The loophole does not impact iPhones because iOS mandates its native calling interface for incoming calls.[9to5Google]
- The security issue has been submitted to WhatsApp and Google, with no formal update released yet.[9to5Google]
What remains uncertain
- It is not yet known when Meta or WhatsApp will issue a patch to resolve the vulnerability.[9to5Google]
- The full list of affected Android hardware manufacturers and operating system versions remains unconfirmed beyond the tested devices.[9to5Google]