WhatsApp, Slack Notifications Could Hijack Google Gemini on Android
Summary: SafeBreach researcher Or Yair found that a single poisoned notification from WhatsApp, Slack, SMS, Signal, Instagram, or Messenger could hijack Google Gemini's voice assistant on Android, making it open connected windows, fake a message from a contact, launch a Zoom call, or poison its long-term memory, with no malicious app required. SafeBreach reported the findings to Google's Vulnerability Reward Program on August 17, 2025, and Google confirmed on November 14, 2025 that content-classifier improvements mitigated the notification injections and the Delayed Tool Invocation bypass, with no CVE assigned and no evidence of use in the wild.
Why it matters: Gemini's Utilities feature treats notification text as instructions, so anything that can push a notification to an Android phone can deliver a payload - an attack surface Yair called "effectively infinite." Because the fix is server-side and there is no app update to chase, the only remaining control is whether Gemini reads notifications at all.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026