SafeBreach Details How Android Notifications Could Hijack Google Gemini

Summary

SafeBreach researcher Or Yair described Fake Context Alignment, a technique using Android notifications to bypass Gemini safeguards and trigger actions or poison memory. Google says server-side mitigations are in place; there is no evidence it was used in the wild.

Key points

Or Yair reported that Gemini’s Android notification-reading feature could treat hostile notification text as instructions; the technique required no malicious app.
Fake Context Alignment combined misleading authorization prompts with a harmless spoken exchange to bypass checks on sensitive actions.
Demonstrated impacts included opening connected devices or apps, initiating a Zoom call, downloading files, and persistently changing Gemini’s account-level memory.
SafeBreach reported the findings to Google’s Vulnerability Reward Program on August 17, 2025; Google confirmed mitigations on November 14, 2025.
Google says server-side changes address the notification injections and Delayed Tool Invocation bypass; no app update is required.
The report says there is no evidence the technique was used in the wild. Users can disconnect Gemini’s Utilities app or disable the Google app’s notification-reading permission.

Article Details

Attack Vectors: A poisoned Android notification from apps such as WhatsApp, Slack, SMS, Signal, Instagram, or Messenger could be interpreted by Gemini as an instruction.
Fake Context Alignment combined a foreign-language authorization prompt or a prompt hidden in a hyperlink with harmless spoken dialogue, causing the user’s “Yes” to authorize a sensitive action.
After authorization, the demonstrated actions included opening connected windows, launching apps, following a redirect to a Zoom app link, and saving attacker-chosen information to Gemini’s account-level memory.
The technique could also create recurring Gemini tasks, such as reading recent messages daily at 8 PM.
Defensive Notes: Google confirmed server-side content-classifier improvements mitigated notification injections and the Delayed Tool Invocation bypass; no app update is required.
Users can disconnect the Utilities app in Gemini’s Connected Apps settings to prevent Gemini from reading notifications.
Users can turn off the Google app’s “Notification read, reply & control” permission on Android.

People

Or YairSafeBreach researcher who demonstrated Fake Context Alignment and reported the findings to Google’s Vulnerability Reward Program.

Vendors

GoogleSafeBreach researcher Or Yair showed that a single poisoned notification on Android could trick Google Gemini into faking messages, opening windows, joining Zoom calls, and even poisoning long-term memory without any

Products

AndroidSafeBreach researcher Or Yair showed that a single poisoned notification on Android could trick Google Gemini into faking messages, opening windows, joining Zoom calls, and even poisoning long-term memory without any Facebook Messenger#GoogleGemini GeminiSafeBreach researcher Or Yair showed that a single poisoned notification on Android could trick Google Gemini into faking messages, opening windows, joining Zoom calls, and even poisoning long-term memory without any Google CalendarThe research, published by SafeBreach’s Or Yair, follows the team’s earlier “Invitation Is All You Need” work, which pulled off similar tricks through malicious Google Calendar invites.Google HomeSmart home control through Google Home: connected windows, boilers, and lights.Instagram#GoogleGemini Signal#GoogleGemini Slack#GoogleGemini WhatsApp#GoogleGemini Zoompoisoned notification on Android could trick Google Gemini into faking messages, opening windows, joining Zoom calls, and even poisoning long-term memory without any malicious app installed.