Android notifications bug might trick you into opening a dangerous hyperlink

[ad_1] <img class="e_Bg" decoding="async" loading="eager" sizes="(min-width: 64rem) 51.25rem, 80vw" title="one ui 7 notifications split design hero" srcset="https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-scaled.jpg 2560w, https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-64w-36h.jpg 64w, https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-1000w-563h.jpg 1000w, https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-1920w-1080h.jpg 1920w, https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-1536w-864h.jpg 1536w, https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-675w-380h.jpg 675w, https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-300w-170h.jpg 300w, https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-1280w-720h.jpg 1280w, https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-840w-472h.jpg 840w" alt="Notifications in One UI 7 on a Galaxy S25 Ultra." src="https://www.androidauthority.com/wp-content/uploads/2025/05/one-ui-7-notifications-split-design-hero-scaled.jpg"/> Joe Maring / Android Authority

TL;DR

A bug in Android notifications may cause the “Open hyperlink” button to open a special hyperlink than the one displayed. Hidden characters within the messages can confuse the system, inflicting it to open a hyperlink that solely makes up part of the one within the displayed notification. Till Google points a repair, it’s most secure to keep away from utilizing the “Open hyperlink” button and open hyperlinks manually within the app.

Replace, June 13, 2025 (5:19 PM ET): Google has reached out to Android Authority with a touch upon this researcher’s findings. A spokesperson tells us:

We're conscious of this analysis and we're actively engaged on a repair for this concern that might be rolling out in a future safety replace. As common finest safety observe, we all the time advise customers to keep away from clicking on hyperlinks from unknown or suspicious message senders.

That’s strong recommendation, and we stay up for seeing Google’s mitigation in motion as soon as the repair is prepared.

Unique article, June 13, 2025 (11:40 AM ET): You would possibly wish to suppose twice earlier than tapping that hyperlink in your Android notifications, even when it appears secure. A newly found bug signifies that the hyperlink you see within the notification may not be the one you’re really opening, and the possibly harmful penalties are obvious.

In a transparent and detailed weblog put up, safety researcher Gabriele Digregorio lays out how Android’s “Open hyperlink” button — the one which exhibits up in notifications from apps like WhatsApp, Instagram, or Slack — may be manipulated to ship customers to a totally totally different web site than the one proven. The trick entails inserting hidden Unicode characters right into a message, which might idiot Android into studying the textual content in another way when deciding which a part of the notification textual content is the hyperlink.

For instance, the system would possibly present you a hyperlink to Amazon.com, however whenever you faucet “Open hyperlink,” it subtly takes you to zon.com as an alternative. That’s precisely what occurred in a single check, the place an invisible character was used to separate the phrase into two. Android displayed the total handle within the notification as if it have been legit, however handled solely the second half (zon.com) because the precise hyperlink. Digregorio demonstrates this instance within the YouTube video beneath.

It’s straightforward to see how this may very well be used to trick folks into visiting phishing websites, and even to set off actions inside apps by way of deep hyperlinks. One instance in Digregorio’s report exhibits a WhatsApp hyperlink that opens a chat with a preset message. It is a reliable WhatsApp function, but it surely’s probably dangerous if used deceptively. In principle, apps ought to all the time ask for affirmation earlier than finishing up any motion triggered by a hyperlink. Nevertheless, some don’t, which suggests tapping the flawed hyperlink might launch one thing immediately.

Google was notified in regards to the bug in March however hasn’t patched it but. In correspondence with the researcher, Google assessed the difficulty as average severity, which seems to imply it is going to be addressed in a future replace, however doesn’t warrant a separate and instant safety patch. On the time of the weblog’s publication on Wednesday, the difficulty nonetheless affected telephones operating Android 14, 15, and 16, together with the Pixel 9 Professional. iPhones behave in another way, highlighting suspicious hyperlinks extra clearly, however comparable methods are technically attainable.

Till a repair arrives, the most secure possibility is to keep away from tapping these notification-generated hyperlinks altogether. If one thing appears necessary, open the app immediately as an alternative, and double-check any hyperlinks earlier than you go to them.

Received a tip? Discuss to us! E mail our workers at information@androidauthority.com. You may keep nameless or get credit score for the data, it is your alternative. [ad_2] Source link