Android Gemini Bug Allows SMS/WhatsApp From Locked Screen

A critical security flaw has been identified within Android's integration with Google's Gemini AI, enabling unauthorized access to send SMS and WhatsApp messages from a locked device. This vulnerability bypasses the need for the device's PIN or biometric authentication, effectively allowing anyone with physical access to the phone to send messages. The exploit was detailed by security researcher Mishaal Rahman, who demonstrated how the Gemini assistant could be invoked on a locked screen to initiate message composition and sending.

Rahman's findings indicate that the issue stems from how the Gemini assistant handles user input and permissions when activated on the lock screen. By specifically interacting with the Gemini interface, an attacker can trick the system into granting message-sending privileges without proper verification. This means that even if a phone is secured with a PIN, password, or fingerprint, the Gemini bug can be exploited to send messages, potentially leading to misuse of the owner's identity or the dissemination of unwanted communications.

The implications of this bug are significant, as it compromises the fundamental security measure of a locked screen. Users rely on these locks to prevent unauthorized access to their personal data and communication channels. The ability for an attacker to send messages from a locked phone could lead to social engineering attacks, harassment, or the sending of sensitive information without the owner's consent. Google has been notified of the vulnerability, and a fix is expected in a future software update. Until then, users are advised to be cautious about who has physical access to their devices.