{"id":482871,"date":"2026-06-04T15:07:10","date_gmt":"2026-06-04T15:07:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/482871\/"},"modified":"2026-06-04T15:07:10","modified_gmt":"2026-06-04T15:07:10","slug":"malicious-whatsapp-slack-alerts-could-have-exposed-millions-of-android-users","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/482871\/","title":{"rendered":"Malicious WhatsApp, Slack Alerts Could Have Exposed Millions of Android Users"},"content":{"rendered":"\n

A routine phone notification could have become an attack path for Google Gemini<\/a> on Android, according to new research from SafeBreach.<\/p>\n

The now-mitigated issue involved crafted alerts from WhatsApp, Slack, SMS, Signal, Instagram, and Messenger. SafeBreach said the alerts could influence how Gemini handled notification text, alter spoken responses, impersonate trusted contacts, trigger connected tools, and poison long-term memory.<\/p>\n

Google addressed the issue with server-side content-classifier improvements. Researchers found no evidence of real-world exploitation.<\/p>\n

Researchers found a notification-based prompt injection path<\/p>\n

SafeBreach Labs said<\/a> its researchers found the issue while testing Gemini\u2019s Android Utilities feature, which can read and respond to phone notifications. The flaw affected how Gemini processed untrusted notification text from messaging and social apps<\/a>.<\/p>\n

The research was published on June 3 by Or Yair, security research team lead at SafeBreach. It followed the company\u2019s earlier \u201cInvitation Is All You Need\u201d work, which showed how malicious Google Calendar invites<\/a> could manipulate Gemini.<\/p>\n

\u201cThe main purpose of Fake Context Alignment is to create a dual illusion: presenting a legitimate authorization scenario to Gemini\u2019s behind-the-scenes security mechanisms, while presenting a completely different, benign scenario to the victim,\u201d Yair wrote in the SafeBreach report.<\/p>\n

The Hacker News reported<\/a> that the attack did not require a malicious app<\/a> on the victim\u2019s phone. An attacker only needed to send a crafted notification that Gemini might later summarize or read aloud.<\/p>\n

Fake Context Alignment bypassed newer guardrails<\/p>\n

Google has already added protections after the earlier calendar-based research, but SafeBreach said Yair found a new bypass called Fake Context Alignment.<\/p>\n

The technique created two versions of the same interaction. One looked like a legitimate consent to Gemini\u2019s security checks<\/a>. The other one sounded harmless to the user.<\/p>\n

In one example, Gemini displayed or processed an authorized question in a foreign language while asking the user an unrelated English question aloud. If the user answered \u201cyes,\u201d Gemini could interpret it as approval of the hidden action.<\/p>\n

According to Dark Reading<\/a>, the technique could support social engineering, smart home control, unauthorized video streams, and long-term memory poisoning. Yair told Dark Reading, \u201cWe do need to treat all external input as not trusted because all external input is a potential instruction.\u201d<\/p>\n

Google says the issue has been fixed<\/p>\n

SafeBreach noted that Google has already addressed the issue. The fix was made on Google\u2019s side, so users do not need to install a specific Gemini app update<\/a> to receive the mitigation.<\/p>\n

SafeBreach further clarified that no CVE was listed for the issue and that there was no evidence the technique had been used in the wild.<\/p>\n

On Android, users can limit exposure<\/a> by disabling Gemini\u2019s Utilities app in the Connected Apps settings or by turning off the Google app\u2019s \u201cNotification read, reply & control\u201d permission. Those settings control whether Gemini can read and respond to notifications.<\/p>\n

For organizations, the finding serves as a reminder that AI assistant permissions can have security implications<\/a> beyond the assistant itself. Notification access, connected app permissions, and policies for AI tools on managed devices all affect how much outside content an assistant can process or act on.<\/p>\n

See how attackers used a Meta AI support exploit<\/a> to hijack the Obama White House Instagram account.<\/p>\n","protected":false},"excerpt":{"rendered":"A routine phone notification could have become an attack path for Google Gemini on Android, according to new…\n","protected":false},"author":2,"featured_media":482872,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":["post-482871","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/482871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=482871"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/482871\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/482872"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=482871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=482871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=482871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}