A recently discovered flaw in WhatsApp for Android has sparked privacy concerns, as it permits unauthorized access to the phone’s photo gallery through a video call. This vulnerability, revealed by security researcher Jose Rodriguez, is causing alarm due to its ease of exploitation without any technical skill.
Discovery and Reporting
Security expert Jose Rodriguez, known for past discoveries of lock screen bypasses, identified the issue and promptly reported it to Meta and Google. Despite this, a patch has yet to be released, leaving many devices vulnerable. The exploit requires physical access to a locked Android phone but no specialized tools or hacking expertise.
To activate the bug, an individual needs to answer an incoming WhatsApp video call on the locked device. Once the call connects, the effects icon can be tapped, leading to a menu with various tabs. By navigating to the backgrounds tab and selecting “Create with Meta AI,” followed by “Edit photo,” the phone’s entire photo gallery becomes accessible without requiring authentication.
Potential for Misuse
This vulnerability could be particularly dangerous as a tool for stalkerware. It allows anyone with access to the phone, such as a partner or acquaintance, to view private images without the owner’s knowledge. The exploit is stealthy, leaving no indication that the photos were accessed.
Devices like the Google Pixel 6 Pro and Oppo K13 are susceptible, while others like the Samsung Galaxy S25 Ultra are protected by additional authentication measures. The variance in susceptibility suggests the flaw arises from manufacturer-specific lock screen customization rather than core Android issues. Apple’s iPhones remain unaffected due to their use of CallKit, which blocks the exploit.
Mitigation and Recommendations
To mitigate the risk, users can alter WhatsApp’s permission settings to limit its access to photos and videos. By setting permissions to “Allow limited access,” the app can only access a pre-selected set of images, closing the loophole temporarily.
With over two billion users, WhatsApp’s widespread adoption highlights ongoing security challenges where convenience features unintentionally compromise device security. Users should modify their settings promptly and remain vigilant for official updates from Meta or Google to address this issue.
In light of these concerns, it’s imperative for WhatsApp users to take immediate action to secure their devices and protect their privacy from potential exploits.
