In WhatsApp Meta AI Bypassed Android's Lock Screen in 15 Seconds
A vulnerability in WhatsApp for Android let anyone with 15 seconds of physical access open the entire photo gallery on a locked phone — no PIN, no fingerprint, no malware. This is a full technical breakdown of how the Meta AI feature inside WhatsApp video calls bypassed Android's keyguard, which phones were affected, and how to protect yours.
Covered: Android lock screen security, the setShowWhenLocked window flag, Meta AI in WhatsApp video calls, why Samsung One UI blocked it, why iOS CallKit was immune, and four mitigations you can apply tonight.
A locked phone is not a wall. It is a wall with exactly one legal door — telephony — and for thirty years the room behind that door held nothing but a name and two buttons.
Then generative AI moved in.
We walk the failure properly: what the keyguard actually guarantees, why the telephony exception exists, how setShowWhenLocked gets inherited by a child activity that was never meant to hold it, and why requestDismissKeyguard() — the one call that would have stopped this — was never made.
Then the part that should worry you more than the bug: the same underlying Android release produced opposite outcomes. Stock Pixel and Oppo ColorOS were exposed. Samsung One UI killed it on contact. Apple never entered the contest at all, because iOS routes calls through CallKit and WhatsApp's feature set is simply not on screen until you unlock.
Coordinated disclosures were filed with Meta and Google. Until a fix ships and actually reaches your specific handset, the mitigation is yours — and there are four of them, at 7:24.
CHAPTERS
0:00 Cold Open
1:12 The Only Legal Door
2:08 Feature Creep
2:49 Six Hops
4:17 The Fatal Flaw
5:12 Four Phones
6:29 Who Has To Fix It
7:24 Tonight
8:54 Sources
9:02 Where To Go Next
MITIGATIONS COVERED
WhatsApp's built-in app lock (biometric gate on the app itself)
Lock-screen privacy settings / suppressing interactive overlays
Hardware-backed containers: Secure Folder, Android Work Profile
Physical custody — the unglamorous one that defeats the whole category
SOURCES
Research: Jose Rodriguez (lock-screen media bypass, WhatsApp for Android)
Reported to: Meta Platforms, Google LLC
Reporting: Notebookcheck, Sportskeeda Tech
NOTE ON THE FOOTAGE
Every device sequence in this video is an illustrative reconstruction built from published descriptions. No exploit code, no live walkthrough, and no target device is shown. This is a defensive analysis for people who build and carry phones.
#MetaAI #WhatsApp #Android #CyberSecurity #TechNews #AI