CVE-2025-12080: Intent Abuse in Google Messages for Wear OS for Silent Message Sending
On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTIONSENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented.
Due to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user’s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12080?
CVE-2025-12080 is considered a high-severity vulnerability due to its impact on privacy and data integrity on Wear OS devices.
How do I fix CVE-2025-12080?
To fix CVE-2025-12080, update the Google Messages application to the latest version provided by Google.
What impact does CVE-2025-12080 have on Wear OS devices?
CVE-2025-12080 allows potential attackers to exploit incorrectly handled ACTION_SENDTO intents, compromising SMS/MMS security on Wear OS devices.
Which versions of Google Messages are affected by CVE-2025-12080?
CVE-2025-12080 affects the Google Messages application when set as the default SMS/MMS/RCS application on Wear OS devices.
Is there a workaround for CVE-2025-12080 before applying a patch?
Currently, there are no known workarounds for CVE-2025-12080, and users are advised to update as soon as a fix is available.