Google Patches Lock Screen Vulnerability in Gemini AI
Google has acknowledged and begun patching a notable security vulnerability in the Android version of its Gemini AI assistant. Tracked by security researchers, the flaw allowed individuals with physical access to a locked smartphone to bypass the PIN, pattern, or biometric lock screen. By exploiting a specific gesture sequence involving Gemini’s overlay interface, an unauthorized person could send unauthorized text messages, launch select applications, and view private device data without unlocking the device. Here is how the vulnerability functioned and how to protect your smartphone.
How the Gemini Lock Screen Bypass Flaw Worked
The vulnerability stemmed from a race condition between Gemini AI’s floating system overlay and Android’s secure keyguard lock screen process. When a user invoked Gemini over a locked screen (either via voice trigger or power button press), the AI interface rendered an “Add attachment” button alongside an interactive prompt. Security researchers discovered that tapping the attachment button and a confirmation prompt simultaneously with a precise multi-touch gesture caused the keyguard process to crash temporarily. This left the underlying phone UI accessible in a logged-in state without requiring a correct PIN, pattern, or fingerprint scan.
Risks: Theft and Unauthorized Messaging
For stolen or unattended smartphones, this vulnerability posed severe privacy risks. Someone with physical possession of the locked device could manipulate Gemini to compose and send SMS messages, transmit WhatsApp chats, read incoming notifications, or query sensitive calendar appointments. If paired with social engineering techniques, attackers could use the bypass to request 2FA verification codes or trigger unauthorized password reset requests.
How to Check Your Fix and Secure Your Lock Screen
Google has deployed a server-side fix alongside an update to the Gemini app and the July 2026 Security Patch rollout. To ensure your device is fully protected against lock screen assistant exploits:
- Open the Google Play Store, search for Gemini, and tap Update to install the latest build.
- Open Settings > Security & Privacy > Device Unlock > Lock Screen.
- Select Assistant on Lock Screen (or Gemini on Lock Screen) and toggle “Allow assistant responses on lock screen” to OFF if you want to prevent any lock screen voice interactions completely.
Disabling assistant responses on the lock screen guarantees that voice assistants will require a valid fingerprint or PIN authentication before executing commands. For more mobile security vulnerabilities, bug fixes, and privacy guides, visit Android People.