A newly disclosed attack chain can potentially let someone with physical access to a locked Android phone browse its photo gallery through an incoming WhatsApp video call.
The path is essentially:
WhatsApp call → Effects → Backgrounds → Meta AI → Edit Photo → Gallery
No PIN, pattern, or biometric authentication is required once the vulnerable path is available.
Testing found the behavior on some Pixel and Oppo devices, while Samsung's One UI blocked the same path with authentication.