# Google Gemini Voice Assistant Vulnerable to Hijacking via Poisoned Notifications


## The Threat


Google's Gemini voice assistant on Android contained a critical vulnerability that could allow attackers to hijack the AI agent through crafted notifications from messaging apps, according to research published by SafeBreach security researcher Or Yair. The attack requires no malicious app installation on the target device—an attacker simply needed to deliver a specially crafted notification through WhatsApp, Slack, SMS, Signal, Instagram, Messenger, or any other notification-enabled app. Gemini's Utilities feature, which can read and interact with incoming notifications, treated hostile notification text as legitimate instructions it could execute.


The vulnerability is particularly dangerous because it exploits the implicit trust users place in their notification systems. Since notifications arrive asynchronously and often while users are distracted (driving, working, in meetings), they create an ideal attack surface for social engineering at scale. An attacker controlling a legitimate business notification channel—a marketing email gateway, SMS platform, or app notification service—could potentially target millions of users simultaneously without triggering traditional malware detection.


What makes this attack sophisticated is the "Fake Context Alignment" bypass technique Yair developed. Rather than sending obvious malicious instructions, the payload hides authorizations in foreign language prompts buried inside muted links, creating a mismatch between what Gemini announces aloud and what the backend executes. When a user says "yes" to what sounds like "Is that all you needed?" they're actually authorizing an action they never heard about—opening windows, launching apps, or joining a Zoom call without permission.


## Severity and Impact


| Aspect | Details |

|--------|---------|

| CVE ID | No CVE assigned |

| CVSS Score | Not officially rated; estimated High (7.5+) |

| Attack Vector | Network (notification delivery) |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | Required (response to obfuscated authorization) |

| Scope | Changed (impacts beyond Gemini) |

| Affected Component | Google Gemini Utilities feature (Android only) |

| Status | Patched; no evidence of active exploitation |


## Affected Products


  • Google Gemini (all versions on Android with Utilities feature enabled)
  • Operating System: Android (iOS and web versions unaffected)
  • Dependent Services: Any app capable of sending notifications:

    • - WhatsApp

    - Slack

    - SMS/MMS

    - Signal

    - Instagram Direct Messages

    - Facebook Messenger

    - Other notification-enabled applications


    Note: This vulnerability does not affect Gemini on iOS or web platforms, where the Utilities notification-reading feature is not available.


    ## Mitigations


    For End Users:

  • Disable Gemini's Utilities feature if you don't actively use voice commands for notification management
  • Review connected smart home devices in Google Home settings and remove any unnecessary integrations
  • Be cautious when responding to voice prompts from Gemini, especially when distracted or driving
  • Keep Android OS and the Google Gemini app updated to the latest version
  • Monitor linked apps and services in your Google account settings for unauthorized access
  • Consider using authentication apps with additional security layers for sensitive actions

    • For Organizations:

  • Audit employee use of Gemini on Android devices, particularly in sensitive environments
  • Restrict notification delivery from third-party applications on managed devices via MDM policies
  • Disable Gemini Utilities features on corporate-managed Android devices if not required
  • Implement additional authorization layers for critical operations (smart home, file access, app launching)
  • Educate employees about the risks of voice-based authorization when notifications are involved
  • Monitor for unusual smart home device activity or app launches initiated through voice commands

    • For Developers:

  • If integrating with voice assistants, implement explicit user confirmation dialogs separate from ambient notifications
  • Avoid hiding authorization prompts within links, muted text, or foreign language fallbacks
  • Require synchronized context between visible and executed actions for sensitive operations
  • Test voice assistant integrations against prompt injection attacks, especially through notification vectors

    • ## References


  • SafeBreach Research: Or Yair's full technical publication on Gemini notification hijacking vulnerability
  • Google Security Advisory: Official Gemini patch and mitigation guidance
  • Related Research: "Invitation Is All You Need"—SafeBreach's prior work on Google Calendar-based prompt injection attacks against Gemini
  • Google Gemini Documentation: Security best practices for Utilities feature and connected app integrations

    • ---


    ## HackWire Analysis


    This vulnerability represents a fundamental shift in how we should think about AI agent attack surfaces. The research demonstrates that the traditional security model—protect the device, protect the app, verify the user—breaks down when an AI agent is trained to treat ambient environmental inputs (notifications, calendar invites, search results) as actionable instructions.


    What's particularly concerning is the pattern: SafeBreach disclosed the Calendar-based "Invitation Is All You Need" attack, Google hardened Gemini's authorization checks, and Yair immediately found a bypass. This isn't a sign of a flawed patch—it's evidence that prompt injection through side-channel inputs is fundamentally difficult to defend against. Every notification, calendar entry, and search result becomes a potential attack vector if the AI agent reads it for context. The attack surface isn't a bug to patch; it's an architectural problem built into how Gemini works on Android.


    The Fake Context Alignment technique deserves close attention. By hiding authorizations inside muted links and foreign language prompts, Yair created a scenario where the security check (the backend authorization) and the user's mental model (what they heard and agreed to) diverged completely. This is a new category of risk: authorization laundering. Future voice assistant attacks will likely exploit this mismatch more aggressively, especially as voice interfaces become the primary control mechanism for smart homes and mobile devices.


    The fact that this was found through research but not exploited in the wild is fortunate. However, the attack's requirements are low—an attacker just needs notification delivery, which is trivially available through legitimate channels. We should expect to see variants of this technique applied to other voice assistants and AI agents in the coming months, particularly as more devices and services integrate AI-driven decision-making.


    The industry takeaway: voice-based authorization is not sufficient for sensitive actions. Any system that executes commands based on voice input needs an independent confirmation mechanism that cannot be spoofed through notification manipulation or language obfuscation.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)