Google Wear OS Flaw Lets Any App Send Texts on Behalf of Users

A critical vulnerability in Google Messages for Wear OS has been identified, allowing any installed app to send text messages on behalf of the user without permissions, confirmation, or user interaction. Identified as CVE-2025-12080, the flaw stems from improper intent handling on Wear OS when Google Messages acts as the default SMS, MMS or RCS app.

Security researcher Gabriele Digregorio discovered the vulnerability in March 2025 and was awarded a bounty through Google’s Mobile Vulnerability Reward Program for responsible disclosure. The exploit works by abusing ACTION_SENDTO intents across four URI schemes (sms:, smsto:, mms:, mmsto:), with the attacker able to trigger message sending to arbitrary numbers without the user’s knowledge.

Testing confirmed the vulnerability on Pixel Watch 3 devices running Wear OS with Android 15, and Google has been notified; users are advised to update Google Messages when patches become available and to review app permissions carefully, choosing alternative messaging apps where possible.