A WhatsApp photo lock loophole on some Android phones can expose private gallery images while the handset is still locked, according to reporting that began with researcher Jose Rodriguez and follow-ups from 9to5Google and NotebookCheck.
It is an Android-side issue that needs physical access to the phone, not a remote hack over the internet. Meta’s WhatsApp team has since said a fix is rolling out; until every handset has the update, limiting WhatsApp’s photo permission remains the practical safeguard.
How it works
At a high level, reporting describes a locked Android handset where WhatsApp’s video-call interface can still open a media path that shows gallery photos before the device asks for a PIN, pattern or biometric. The rest of the phone stays locked. Other apps and settings are not opened by this behaviour.
9to5Google’s Ben Schoon, citing Rodriguez and NotebookCheck’s tests, stresses this is not a remote break-in. Someone has to be holding the phone. NotebookCheck’s Yuval Goel, writing on 2 September 2026, said the issue had been reported to Meta and Google.
Device results are mixed. NotebookCheck found a Pixel 6 Pro on Android 17 and an Oppo K13 on ColorOS 16 allowed photos to appear without unlocking; a Galaxy S25 Ultra on One UI 8.5 forced the lock first. MakeUseOf later said a Razr Fold and a Tecno Pova 6 were unaffected, with inconclusive results on a Samsung Z Fold 8. That is a list of named test units, not a census of every Android sold in the UAE.
iPhone is unaffected. 9to5Google says WhatsApp is forced to use the native iOS calling interface; NotebookCheck points to Apple’s CallKit as the reason the custom WhatsApp lock-screen path does not appear.
Is it fixed?
As of early September 2026, WhatsApp has confirmed it has started rolling out a fix. On 3 September, WhatsApp replied publicly to the researcher that a fix was underway and described the case as one needing physical access to a user’s device, according to secondary reporting that quotes that reply.
A rollout is not the same as every phone already being patched. Check the Play Store for a WhatsApp update, install it when it appears, and treat older builds as still at risk until the update lands on your handset.
How to protect your chats (UAE / Android)
WhatsApp is everyday infrastructure in the UAE, including for group chats that sit on most home screens. Pixel and Oppo owners especially should harden permissions while updates propagate.
9to5Google’s published workaround is to set WhatsApp’s photo and video access to limited (or selected) in Android’s app permissions, rather than full gallery access. Google’s Android Help page covers how to change an app’s Photos and videos permission. That is a hardening step, not a way to trigger the flaw.
Also keep WhatsApp and Android system updates current, and do not leave an unlocked-looking call screen in someone else’s hands. Physical access is the shared thread in every report of this loophole.
Does this WhatsApp loophole affect iPhone?
No. 9to5Google says WhatsApp on iPhone is forced to use the native iOS calling interface. NotebookCheck names Apple’s CallKit as the reason the custom WhatsApp screen, and therefore this photo path, does not appear on a locked iPhone.
Which Android phones are affected?
NotebookCheck found a Pixel 6 Pro on Android 17 and an Oppo K13 on ColorOS 16 allowed photos to appear without unlocking. 9to5Google summarised that as Pixel and Oppo devices. A Galaxy S25 Ultra on One UI 8.5 forced an unlock. MakeUseOf separately found a Razr Fold and a Tecno Pova 6 unaffected, and was inconclusive on a Samsung Z Fold 8. This is not a claim that every Android phone is exposed.
Has WhatsApp released a patch?
WhatsApp has said it has started rolling out a fix (public reply dated 3 September 2026). Earlier coverage on 2 September noted no update had been announced yet. Install WhatsApp updates from the Play Store as they appear; do not assume every device is already patched.
How do I limit WhatsApp’s access to photos on Android?
9to5Google’s published workaround is to set WhatsApp’s photo and video access to limited in Android’s app permissions. Google’s Android Help page on changing app permissions covers the Photos and videos setting. That is a hardening step, not a way to trigger the flaw.
Can this happen over the internet?
No. NotebookCheck and 9to5Google both describe a locked handset that someone is holding. 9to5Google also says the rest of the lock screen still blocks other parts of the device.
