A vulnerability in WhatsApp for Android, disclosed in early September 2026, allows anyone who picks up a locked phone to browse its entire photo gallery without entering a PIN, pattern or biometric credential. The flaw requires no hacking skill, no malicious code and no software installation. It uses only the ordinary functions of the app itself.
How the exploit works
The attack is disarmingly simple. An attacker needs physical access to the target device and a second phone that can place a WhatsApp video call. When the call arrives, the locked phone displays WhatsApp's call interface. Android allows users to answer incoming calls without unlocking the device, a convenience feature designed for regular phone calls that WhatsApp inherits.
Once the video call connects, the attacker taps the filter icon, then selects the "Create with AI" option in the background wallpaper selector. Pressing "Modify photo" opens WhatsApp's media picker, which displays every image stored on the device. The picker is presented on top of the call interface, which is itself running over the lock screen. At no point does Android demand authentication.
The entire sequence takes roughly ten seconds. The attacker does not need to install anything, modify any setting or even know the device's unlock method.
Why iOS escapes the problem
The same vulnerability does not exist on Apple's iPhone. When an incoming call reaches an iOS device, the operating system's own call interface takes precedence, replacing whatever screen the third-party app might attempt to render. WhatsApp never gets the opportunity to display its own call UI over the lock screen, so there is no pathway from the incoming call to the photo picker without first unlocking the device.
The difference stems from a fundamental architectural choice. Android permits apps that declare the appropriate permission to present interfaces over the lock screen, enabling features such as turn-by-turn navigation or alarm clocks to function without a full unlock. Apple's approach is more restrictive: third-party apps on iOS cannot render their own lock-screen interfaces for incoming calls. The trade-off is between convenience and a smaller attack surface.
Meta confirms the flaw
Meta, WhatsApp's parent company, has acknowledged the vulnerability. In a statement, the company said the issue "se limite à un cas rare où une personne a physiquement accès à l'appareil d'un utilisateur", restricting it to a rare case where someone has physical access to the user's device. A patch is being distributed through the Google Play Store.
Meta's description of the attack as "rare" is technically defensible but understates the practical risk. Physical access attacks are common in domestic settings: a partner, housemate or colleague who briefly holds an unattended phone could exploit this flaw in seconds. The vulnerability is also relevant in law enforcement and border control contexts, where officials may have access to a device but not its unlock credentials.
The limits of the physical access defence
Security researchers have long distinguished between remote and physical attacks. Remote exploits, which can be launched from anywhere on the network, are considered the more dangerous category. Physical access vulnerabilities require proximity and opportunity, which narrows the pool of potential attackers.
That distinction is valid, but it can create a false sense of security. A phone left on a desk at work, a bedside table at home or a charging point in an airport lounge is physically accessible to anyone nearby. The WhatsApp flaw demands no technical expertise whatsoever. It works with the stock, unmodified version of the app. The barrier to exploitation is not skill but opportunity.
What Android users can do now
Until the patch reaches all devices, users can reduce their exposure by restricting WhatsApp's access to photos. In Android Settings, under Applications, then WhatsApp, then Permissions, then Photos and Videos, the option "Allow limited access" lets users deny the app access to specific albums. The drawback is that this restriction also applies during normal use, making it harder to share photos through the app.
An alternative is to check whether the device's settings allow disabling WhatsApp's ability to appear over the lock screen, though this varies by Android version and manufacturer. Enabling automatic updates in the Google Play Store will ensure the patch is applied as soon as it becomes available.
Platform responsibility and European regulation
The vulnerability raises questions about how much trust Android places in third-party apps to manage their own lock-screen behaviour. Google's operating system allows apps to declare that they need to function over the lock screen, and WhatsApp's call interface is one such case. The assumption is that the app itself will enforce appropriate access controls. When it fails to do so, the operating system does not catch the error.
Under the European Union's Digital Services Act and the forthcoming Cyber Resilience Act, digital platforms face growing obligations to address security flaws promptly and transparently. WhatsApp's user base across Europe runs into hundreds of millions. Any vulnerability with direct privacy implications, even one that requires physical access, is a regulatory concern, particularly when it affects a messaging platform owned by a company already under scrutiny for its data practices.
Organisations
Meta
