Google's Gemini Lets Strangers Send Messages From Your Locked Android Phone
Bitdefender, Friday, July 17th, 2026
An Android 16 flaw lets anyone with physical access use Gemini to send SMS and WhatsApp messages without a PIN.
Bitdefender reported that Google is patching a vulnerability in Android 16 allowing anyone with physical access to a locked device to send SMS and WhatsApp messages through Gemini without authentication.
The exploit relies on a specific multi-touch gesture, pressing Continue while simultaneously tapping the attachment button, which bypasses PIN requirements.
Once messages are sent, an attacker can permanently enable Gemini access to other applications such as WhatsApp.
A patch was scheduled to roll out within the week, but users can immediately reduce risk by disabling Gemini's lock screen messaging capabilities in the app's settings.