A security flaw in the Android version of WhatsApp allows someone to access a device's photo gallery on a locked smartphone without needing a PIN, fingerprint, or password. The issue was reported to Meta, which owns WhatsApp, and Google, but it has not yet been fixed. According to one report, answering a WhatsApp video call on a locked Android device opens the entire photo gallery, bypassing the lock screen. No authentication is needed for this access. The vulnerability was discovered by security researcher Jose Rodriguez, who has previously uncovered similar issues in Android and iOS systems. According to another report, no special technical skills are required to exploit this flaw—only physical access to the device is needed. When a WhatsApp video call comes in on a locked Android phone, anyone holding the device can answer without unlocking it, just like with a regular phone call. Once the call is connected, tapping on the video effects icon, navigating to the "Backgrounds" tab, selecting "Create with Meta AI," and then choosing "Edit Photo" opens the entire photo gallery. The system does not prompt for any authentication. The photo editing feature, intended to enhance the calling experience, accesses the device's images without verifying that the user is the phone's owner. A preview of the photos appears before the system asks for a PIN or biometric authentication. This vulnerability does not affect all Android smartphones. Tests by Lukáš Štefanko, a researcher at ESET, showed that devices like the Google Pixel 6 Pro and the Oppo K13 running ColorOS 16 are vulnerable. However, the Samsung Galaxy S25 Ultra with One UI 8.5 redirects users to the lock screen and requires authentication before proceeding. iPhones are not affected. Apple's CallKit framework forces WhatsApp to use the native iOS call interface, which blocks access to the app’s custom menus during a call, including the background replacement tool that allows bypassing the lock screen. Meta has acknowledged the issue and promised a fix soon. In the meantime, users can limit WhatsApp’s access to photos and videos by adjusting the app's permissions in Android settings. This allows restricting WhatsApp’s access to a subset of pre-approved images rather than the entire library. However, this also limits the ability to view photos directly from a conversation, which is a legitimate feature when the phone is unlocked.