WhatsApp, Slack Notifications Could Hijack Google Gemini on Android

A poisoned notification from messaging apps like WhatsApp and Slack could hijack Google Gemini's voice assistant on Android without requiring a malicious app.

• •Fake Context Alignment attack uses two techniques: asking authorization in an unfamiliar language while showing innocuous English text, and hiding malicious prompts in muted hyperlinks.
• •Gemini's Utilities feature treats notification text as actionable instructions, creating an attack surface that extends to any app that can push notifications.
• •Successful attacks can open windows and apps, steal data through geolocated URLs, poison Gemini's account-level memory with fake facts, and create persistent tasks.
• •Google patched the vulnerability server-side after SafeBreach's security report, requiring no app update but users can disable Gemini's notification access in settings.