WhatsApp, Slack Notifications Could Hijack Google Gemini on Android

A prompt injection vulnerability in Google Gemini's voice assistant on Android allowed attackers to hijack the system through poisoned notifications from messaging apps. The attack exploited Gemini's Utilities feature that reads notifications, treating notification text as executable instructions. The technique called 'Fake Context Alignment' used two methods to bypass security checks: 1) Obfuscated - asking authorization questions in foreign languages while displaying innocuous English text, and 2) Muted - hiding malicious authorization prompts in hyperlinks that text-to-speech skips. The attack could fake messages, control smart home devices, force app launches, poison long-term memory, and create persistent scheduled actions. No malicious app installation was required, only the ability to send notifications to the target device.