WhatsApp is having a tough time again.

A lot of people advocate for the use of privacy focused apps such as Telegram or Signal over Whatsapp. Even though people believe WhatsApp’s security features can be hardened by tweaking some settings, recent news is not helping WhatsApp’s image.

Google’s Project Zero team has found a serious bug in WhatsApp for Android. Because of this bug, a hacker can send a malicious media file into a newly created group chat. The file can download automatically without you clicking anything.

This means you can be attacked just by being added to a group and receiving a file. You do not need to open it or tap on it.

The issue happens because WhatsApp automatically downloads media in group chats. Attackers can abuse this behavior to target specific people.

Project Zero says this attack is more likely to be used against specific targets, because the attacker needs to know at least one contact of the victim. Once they know that, repeating the attack is not very difficult.

What WhatsApp has done so far

Meta reportedly pushed a server side change in November 2025. However, Google says this only fixed part of the problem. A full fix is still being worked on.

Until that happens, Google recommends changing some WhatsApp settings to protect yourself.

Disable automatic media downloads

The most important step is to stop WhatsApp from downloading media automatically.

This ensures that photos, videos, audio files, and documents are not saved to your phone unless you choose to download them.

Here is how to do it on Android.

1. Open WhatsApp
2. Tap the three dots in the top right corner
3. Go to Settings
4. Tap Storage and data
5. Under Media auto download, you will see options for mobile data, WiFi, and roaming.
6. For each option, tap it and uncheck Photos, Audio, Videos, and Documents
7. Tap OK

After this, each option should show that no media will be downloaded automatically.

Stop WhatsApp from saving media to your gallery

Even if WhatsApp still downloads some files, you can stop them from appearing in your phone’s gallery.

This helps because files stored in shared storage can sometimes be accessed by other apps or system components.

To do this:

1. Go to Settings
2. Tap Chats
3. Turn off Media visibility

For sensitive chats, open the chat

1. Tap the contact or group name
2. Find Media visibility
3. Set it to No

Keeping media inside WhatsApp makes it harder for malicious files to affect other parts of your phone.

Control who can add you to groups

This attack works only if the attacker can add you to a group.

You can reduce this risk by limiting who is allowed to add you.

1. Go to Settings
2. Tap Privacy
3. Tap Groups
4. Change the setting from Everyone to My contacts

For better security, I would advise to not allow anyone to add you to groups. If needed, they can share invites. To do this, change the setting from Everyone/My contacts to My contacts except… and proceed to select all of your contacts.

Final thoughts

This bug shows why automatic downloads are risky. Even apps that are considered secure can have dangerous flaws.

Until WhatsApp fully fixes this issue, changing these settings is the best way to stay safe.

Keeping your apps updated and being careful with group chats can go a long way in protecting your privacy.