Android lockscreen bypass allows Gemini to send SMS without verification

These things happen from time to time, especially when dealing with such complex software with so many edge cases and even more so with software with special privileges like Gemini’s ability to run from the lock screen.

In traditional “hacking” circles, this is known as an authentication bypass vulnerability or a lockscreen bypass. It is always so fascinating to observe what things people find or often stumble upon. You can see the short video for yourself. Still, it goes something like this: The user has mindfully disabled access from Gemini to certain apps like Messages, so naturally, once someone with physical access to the device tries to call upon Gemini from the lock screen and tell it to send a message, the phone asks for a PIN. So far so good.

Now the “magic” and clearly broken bit – the user then presses the “Add attachment” button simultaneously with the Continue button, and that bypasses the PIN for some reason. And from there, it’s not just SMS message privileges either. The video shows that the “attacker” managed to re-enable access to WhatsApp, even though it had been previously turned off in Gemini settings as well. Fascinating stuff.

Apparently, this particular vulnerability has been reported since May on Android 16 and is “known” by Google, and there is a fix already on the way. It affects more than just Pixel devices, too, though we don’t have conclusive information on which Android flavors are vulnerable.

Anyway, as we said, these things happen from time to time and not only on Android either. For instance, entire dedicated online communities are searching for such edge case bypass conditions on iOS and often with more malicious intent than simply sending an unauthorized SMS, like unlocking and reselling blocked stolen phones.

Source | Via