Wear OS Messages Flaw (CVE-2025-12080) Allows Unprivileged Apps to Send SMS/RCS Without Permission, PoC Available

SecurityOnline[.]info reports that Wear OS Messages Flaw CVE-2025-12080 allows any installed app to send SMS, MMS or RCS messages on a user’s behalf without permissions or user interaction, a finding disclosed by security researcher Gabriele Digregorio. According to Digregorio’s report, when Google Messages is the default app, ACTION_SENDTO intents using sms:, smsto:, mms:, and mmsto: URI schemes are handled incorrectly, enabling an attacker to trigger message sending without confirmation.

The flaw arises from how Google Messages handles intent requests, effectively turning the app into a “confused deputy” that performs actions on behalf of an unprivileged caller. A proof of concept available on GitHub demonstrates this on a Pixel Watch 3 running Wear OS (Android 15 BP1A.250305.019.w3) with Google Messages version 2025_0225_RC03.wear_dynamic, where the PoC sends a text immediately after launch.

The report notes that exploitation does not require malicious code or special permissions, making the vulnerability highly stealthy given Google Messages is the default messaging app on many Wear OS devices.