Google says it is fixing an Android 16 bug that could let someone holding an unlocked phone use Gemini on the lock screen to send SMS or WhatsApp messages without entering the device PIN. The issue affects devices with Gemini lock-screen access enabled and relies on a specific multi-touch gesture that bypasses an authentication prompt when Gemini asks to open Messages or connect apps such as WhatsApp; no CVE is cited, and Google said the fix was scheduled to deploy this week.
Why it matters: Anyone whose phone is briefly stolen or handled by someone else could be impersonated in texts or messaging apps, which raises fraud and account-recovery risks. Android users should install the fix as soon as it arrives and consider disabling Gemini lock-screen access until patched.
2026.07.17
100% relevant
This article establishes a distinct newly disclosed Android 16 lock-screen authentication-bypass bug involving Gemini and message sending, with Google confirming a fix is rolling out.
← Back to all stories