Loading story…
A reported WhatsApp flaw may allow someone with physical access to certain locked Android phones to browse photos without unlocking the device. An attacker who knows the victim’s WhatsApp number can place a video call, answer it on the target device, and use the in-call background-effects interface to access media that WhatsApp can see. Researcher Jose Rodriguez reported the issue to Meta and Google; no patch had reportedly been released at the time of publication.
The issue requires WhatsApp to have full Android Photos and Videos permission. Tests reportedly affected a Google Pixel 6 Pro and Oppo K13, while a Samsung Galaxy S25 Ultra running One UI required authentication; iPhones were reported as unaffected. Organizations and users can reduce exposure by changing WhatsApp’s Photos and Videos permission from full access to Limited access, restricting the app to selected media.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Researcher Jose Rodriguez disclosed and reported to Meta and Google a WhatsApp issue affecting some locked Android devices. A person with physical access and the victim's WhatsApp number may answer a video call and use in-call effects and photo-editing functions to access photos without device authentication when WhatsApp has full media permission; no official patch was reported at the time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recently discovered vulnerability in WhatsApp allowed researchers to enumerate up to 3.5 billion active accounts by exploiting the app's contact syncing feature. This flaw, responsibly disclosed by researchers at the University of Vienna and subsequently patched by Meta, could have enabled malicious actors to build massive databases of phone numbers linked to WhatsApp, along with associated profile photos and "About" texts. While there is no evidence the vulnerability was exploited in the wild, the incident highlights the risks posed by convenience features and the critical importance of protecting phone numbers as sensitive personal data. In addition to this privacy risk, WhatsApp users are being targeted by a new Android malware that propagates itself through the platform. The malware automatically replies to incoming WhatsApp messages with malicious links, leveraging the trust users place in their contacts to spread further. This attack exploits the phenomenon of "context collapse," where users' social boundaries blur on messaging platforms, making them more susceptible to social engineering. These developments underscore the growing threat landscape facing WhatsApp users, combining both technical vulnerabilities and sophisticated social attacks.
Jun 29, 2026
Google said it is rolling out a fix for an Android 16 lock-screen bypass in **Gemini** that allows someone with brief physical access to a locked phone to send **SMS** and **WhatsApp** messages without entering a PIN, password, or biometric. Researchers and follow-on reporting said the flaw can be triggered through a specific multi-touch interaction when Gemini is invoked from the lock screen and prompted to open apps such as Messages, bypassing the expected authentication step. Google said the issue is not limited to Pixel devices, though it did not identify all affected manufacturers or models. The bug was reproduced on a fully patched **Pixel 6a** and appears tied to Gemini's **Deep Research** and lock-screen app-handoff behavior, where authentication checks can fail during transitions from the lock-screen overlay into the full app. Reporting said the weakness may also let an attacker regain Gemini access to previously disconnected apps, switch accounts, view or delete Gemini conversation history, change some security settings, and exfiltrate data while leaving no failed unlock attempts logged. The researcher who disclosed the issue said it reflects an incomplete fix for an earlier reported vulnerability and points to a broader trust-boundary problem in how lock-screen restrictions are enforced across Gemini activities.
Jul 21, 2026
A group of Austrian researchers demonstrated that WhatsApp's contact discovery feature could be abused to enumerate and extract the phone numbers of 3.5 billion users globally. By automating the process of checking every possible phone number through WhatsApp’s browser-based app, the researchers were able to access not only phone numbers but also profile photos for 57% of users and profile text for 29%. This large-scale data exposure was possible because Meta, WhatsApp’s parent company, did not sufficiently limit the speed or volume of contact discovery requests, despite prior warnings about this vulnerability. In response to this and other security concerns, Meta has expanded its bug bounty initiatives, launching the WhatsApp Research Proxy tool to facilitate deeper research into WhatsApp’s network protocol and platform abuse. The company also reported adding new anti-scraping protections to WhatsApp after the enumeration technique was disclosed. Meta highlighted its ongoing investment in security, noting over $4 million in bug bounties paid out in the past year and the patching of several notable vulnerabilities, including CVE-2025-59489 affecting Quest devices.
Jun 29, 2026