An active debug flag in Microsoft 365 Android apps allowed arbitrary apps on the device to steal authentication tokens and take over user accounts completely.
A manipulated notification via WhatsApp, Slack, SMS, Signal, Instagram, or Messenger could hijack Google Gemini on Android devices and force it to execute arbitrary actions without requiring a malicious app to be installed on the phone.
