A newly disclosed attack chain can potentially let someone with physical access to a locked Android phone browse its photo gallery through an incoming WhatsApp video call. The path is essentially: WhatsApp call → Effects → Backgrounds → Meta AI → Edit Photo → Gallery No PIN, pattern, or biometric authentication is required once the vulnerable path is available. Testing found the behavior on some Pixel and Oppo devices, while Samsung’s One UI blocked the same path with authentication.
Good thing I never granted the read media permission. Whatsapp can use the default photo picker for pictures and video and repeatedly asks for storage permission claiming it becomes limited without it.
I need to manually invoke the media picker whenever I want to send a picture. This lock screen bypass does not work in my case since I never granted the storage or read media permission to whatsapp.
Yeah even I do the same for any app other than onedrive