Google says it is fixing an Android 16 security flaw that can let someone with physical access to a locked phone use Gemini to send SMS and WhatsApp messages without entering the device PIN. The issue matters because a thief could impersonate the owner in convincing scams, including messages to contacts, despite the phone remaining locked.

The bypass involves pressing Gemini’s “Continue” prompt and “Add attachment” button simultaneously after Gemini requests access to Messages. This can enable messaging access and later allow connections to other apps, such as WhatsApp, without authentication; Google says the bug is not limited to Pixel phones and planned a full fix deployment that week, though it did not specify affected models or manufacturers.