WhatsApp has initiated the rollout of a fix addressing a privacy concern affecting Android users, which could potentially allow individuals with physical access to a locked device to view the owner’s photos during a WhatsApp video call.
Details of the Vulnerability
The issue was brought to light by security researcher Jose Rodriguez, who shared his findings on platforms such as YouTube and X. He cautioned that this vulnerability enables unauthorized access to photos without the need to unlock the Android device. Rodriguez had previously alerted both Meta and Google about this concern before making it public.
“This is in plain sight. It’s not hidden, not a secret feature. Not a hack,” Rodriguez emphasized in his disclosure.
In a demonstration video, Rodriguez illustrated how an incoming WhatsApp video call could create a pathway from the lock-screen interface to the device’s photo gallery. Importantly, the attack requires the attacker to physically possess the locked phone and interact with its screen, rather than allowing remote access to the victim’s gallery.
WhatsApp’s Response
In response to Rodriguez’s disclosure, WhatsApp, the messaging platform owned by Meta and utilized by billions globally, confirmed that they have started implementing a fix for the identified issue. “We’ve begun rolling out a fix for this issue, which is limited to a rare case when someone has physical access to a user’s device,” the company stated.
Rodriguez expressed that WhatsApp’s reaction to his findings was positive, noting that he received a response even without tagging the company in his original post on X. However, he mentioned that he had yet to receive a detailed reply regarding the vulnerability report submitted through Meta’s bug bounty program, with Meta only acknowledging receipt and requesting confidentiality while their security team conducted a review.
Additionally, Rodriguez reported the vulnerability to Google’s Vulnerability Reward Program, receiving only automated responses from the tech giant.
Implications and Recommendations
While the requirement for physical access significantly narrows the scope of this flaw compared to vulnerabilities that can be exploited remotely, lock-screen bypasses still pose privacy risks, especially in scenarios where another individual temporarily gains possession of an unattended device.
Android users are advised to promptly install WhatsApp updates as they become available. For those concerned about potential exposure, reviewing and adjusting WhatsApp’s permissions to access photos and videos within Android’s app permission settings is recommended, allowing users to restrict access to specific media where supported by their device.
If you liked this article, be sure to follow us on X/Twitter and also LinkedIn for more exclusive content.
