A security flaw in Android devices allows unauthorized users to send SMS and WhatsApp messages using Gemini from the lock screen, even without knowing the device's PIN.
The vulnerability requires physical access to an Android device and involves a specific multi-touch gesture.
Users can exploit this by simultaneously pressing Gemini's "Add attachment" button and the "Continue" prompt when Gemini requests access to an app like Messages.
This bypasses the PIN authentication, allowing an attacker to send SMS messages.
Further exploitation can grant Gemini access to other applications, such as WhatsApp, by typing "@WhatsApp" in the Gemini text window, again without requiring a PIN.
A security flaw in Android devices allows unauthorized users to send SMS and WhatsApp messages using Gemini from the lock screen, even without knowing the device's PIN. Google has acknowledged the vulnerability and plans to release a fix this week, based on information published by The Register.
The vulnerability requires physical access to an Android device and involves a specific multi-touch gesture. Users can exploit this by simultaneously pressing Gemini's "Add attachment" button and the "Continue" prompt when Gemini requests access to an app like Messages. This bypasses the PIN authentication, allowing an attacker to send SMS messages. Further exploitation can grant Gemini access to other applications, such as WhatsApp, by typing "@WhatsApp" in the Gemini text window, again without requiring a PIN.
While physical access vulnerabilities are often downplayed, the potential for misuse in scenarios like fake kidnapping scams, especially given the prevalence of phone theft, warrants attention. Google has confirmed the bug is not specific to Pixel devices and has implemented a fix scheduled for deployment this week.
Source: The Register
