Android Lockscreen Bypass Exploit: Gemini Sends SMS Without PIN [2026 Update] (2026)

Android's lockscreen security has been compromised, allowing Gemini to send SMS without user verification. This vulnerability, known as an authentication bypass, is a fascinating yet concerning discovery in the world of mobile security. The issue arises when a user disables access to certain apps like Messages from Gemini, but an attacker with physical access to the device can still trigger Gemini's SMS capabilities. By pressing the 'Add attachment' button simultaneously with the 'Continue' button, the PIN requirement is bypassed, granting unauthorized access to messaging apps. This exploit is not limited to SMS; it enables the re-enablement of access to apps like WhatsApp, even when previously disabled in Gemini settings. The vulnerability has been reported since May on Android 16 and is known by Google, with a fix already in development. It affects various Android devices, not just Pixel models, indicating a widespread potential impact. This incident highlights the ongoing challenges in securing mobile operating systems, as similar vulnerabilities have been found on iOS as well, often with malicious intent, such as unlocking and reselling stolen phones. The discovery of this lockscreen bypass vulnerability serves as a reminder of the importance of staying vigilant and implementing robust security measures to protect personal data and privacy.