Security News Android bug lets Gemini send messages without unlocking your phone

[Brownie2019]

Your locked phone wasn't as locked as you thought.
Key takeaways:

• Google is fixing an Android 16 bug that lets Gemini send SMS and WhatsApp messages from locked phones.
• The flaw uses a multi-touch gesture to bypass PIN checks when Gemini hands users from the lock screen to apps.
• Attackers need physical access, but researchers warn phone thefts could make the bug useful for scams or extortion.
• Users can reduce risk by disabling Gemini use without unlocking or blocking calls and messages from the lock screen.

We all love convenience when it comes to technology – but even a strong PIN might not be enough to protect your phone if there is a simple software bug. Google is rolling out a fix for a vulnerability that allows virtually anyone with physical access to an Android 16 device to use Gemini to send SMS and WhatsApp messages from your phone. No PIN required.

The Register says it has received multiple reports of users bypassing device authentication on Android 16 devices that allow access to Gemini from the lock screen.

The exploit relies on a specific multi-touch gesture. Imagine you've disabled Gemini's access to Messages. If someone picks up your phone and asks Gemini to send an SMS, it won’t do it because it no longer has permission.

Full Story:

https://cybernews.com/news/android-bug-gemini-messages-access/

 

[Bot]

Full Story:

https://cybernews.com/news/android-bug-gemini-messages-access/

What users should do

This is a lock-screen authentication bypass involving physical access to the device. It does not mean that an attacker can exploit the issue remotely over the internet, but a stolen or temporarily unattended phone could still be at risk if the device is affected.

Until the relevant update is installed:

• Install the latest Android system update and Google Play system update available for the device.
• Disable Gemini or Google Assistant access from the lock screen, especially any option similar to Use Gemini without unlocking.
• Disable lock-screen access to calls, messages, and other sensitive actions where the device settings allow it.
• Hide sensitive notification content on the lock screen.
• Use a strong PIN rather than a simple four-digit code, although a stronger PIN does not fix this particular software issue.

Settings names and locations can differ by manufacturer and Android build. If the phone has already been lost or stolen, use Google Find Hub/Find My Device to lock or erase it, contact the mobile carrier, and review important account sessions from another trusted device.

The safest conclusion is to apply the vendor update as soon as it is offered and restrict Gemini and messaging functions while the phone remains locked. This report alone does not establish that every Android 16 device or every Gemini configuration is affected.