Cybersecurity researchers have uncovered a sophisticated vulnerability in Google Gemini on Android that could have allowed attackers to manipulate the AI assistant through seemingly harmless notifications from apps such as WhatsApp, Slack, Signal, Instagram, Messenger, and SMS. The attack required no malicious app installation; a crafted notification alone could trick Gemini into performing unauthorized actions.
The vulnerability exploited Gemini’s notification-reading capability within its Utilities feature. Researchers discovered that Gemini could interpret notification content as actionable instructions rather than simple information. This created a massive attack surface, enabling attackers to inject malicious prompts through virtually any service capable of sending notifications to a user's device.
Using a technique called “Fake Context Alignment,” researchers demonstrated how attackers could bypass security safeguards. The method involved disguising authorization requests through foreign-language prompts, hidden hyperlinks, or misleading conversations, tricking users into unknowingly approving sensitive actions. Potential outcomes included opening applications, joining video calls, sending misleading messages, altering account-level memories, and creating persistent automated tasks.
More concerning was the ability to poison Gemini's long-term memory. Attackers could store false information within a user's account, causing incorrect data to persist across devices and future interactions. The vulnerability highlighted the growing risks associated with AI agents that interact directly with user data and applications.
Google treated the issue as a high-priority security concern and implemented server-side fixes to block the attack. Users seeking additional protection can disable Gemini’s notification-reading permissions or disconnect the Utilities feature from connected apps on Android devices.
