CloudSEK Finds Android App API Keys Can Expose Gemini Endpoints
Summary
CloudSEK says 32 API keys embedded in 22 Android apps can access Gemini resources. Attackers who extract them could access files and cached data or exhaust API quotas; actual misuse or data exposure is not reported.
Key points
- CloudSEK identified 32 hardcoded Google API keys in 22 popular Android apps, whose combined user base exceeds 500 million.
- The keys can provide access to Gemini endpoints on the developers’ projects when Gemini is enabled.
- Because Android apps can be unpacked, attackers could extract the keys and make Gemini API calls.
- Potential impacts include access to files and cached content, quota exhaustion, and disruption of legitimate services.
- The article describes possible exposure, not confirmed misuse or compromise of user data.
Article Details
- Event Type
- CloudSEK reported that Google API keys embedded in Android applications can provide unauthorized access to Gemini endpoints.
- Impact
- The 32 keys identified across 22 apps could expose developers’ Gemini files and cached data, and potentially user-submitted content processed by the apps. An attacker with an extracted key could make Gemini API calls, exhaust quotas, and disrupt legitimate services. The apps reportedly have a combined user base of more than 500 million; the article describes potential exposure, not confirmed exploitation or data theft.
Vendors
Products
AndroidThreat actors can extract Google API keys embedded in Android applications to gain access to Gemini AI endpoints and compromise data, CloudSEK warns.GeminiThreat actors can extract Google API keys embedded in Android applications to gain access to Gemini AI endpoints and compromise data, CloudSEK warns.