WhatsApp announced it has begun rolling out a fix for an Android privacy issue that could allow someone with physical access to a locked phone to view the owner’s photos after initiating a WhatsApp video call.
Security researcher Jose Rodriguez publicly disclosed the behavior on YouTube and X, warning that photos could be accessed without first unlocking the Android device. Rodriguez also directly tipped off CyberInsider about the issue and said he had previously reported it to both Meta and Google.
“This is in plain sight. It's not hidden, not a secret feature. Not a hack,” Rodriguez said in his disclosure.
Rodriguez demonstrated the issue in a video showing how an incoming WhatsApp video call can provide a path from the lock-screen call interface to photos stored on the device. The attack does not give a remote caller direct access to the victim’s gallery. Instead, an attacker must have the locked phone physically in hand and interact with its screen.
WhatsApp, Meta’s encrypted messaging and calling platform used by billions of people worldwide, responded publicly to Rodriguez after his disclosure.
“We've begun rolling out a fix for this issue, which is limited to a rare case when someone has physical access to a user's device,” WhatsApp said.
Rodriguez told CyberInsider that WhatsApp reacted well to the disclosure, receiving a response even though he had not tagged the company in his original X post.
However, he said he had not yet received a substantive response to the vulnerability report submitted through Meta’s bug bounty program. Meta had only acknowledged receiving the report and asked him to keep the details confidential while its security team reviewed the submission.
Rodriguez also submitted the issue to Google’s Vulnerability Reward Program and received automated responses from the company.
The physical-access requirement significantly limits the scope of the flaw compared with vulnerabilities that can be exploited remotely. Still, lock-screen bypasses can pose a privacy risk in situations where another person briefly gains possession of an unattended device.
Android users should install WhatsApp updates as soon as they become available. As an additional precaution, users concerned about exposure can review WhatsApp’s permission to access photos and videos under Android’s app permission settings and restrict access to selected media where their device supports that option.
Leave a Reply