Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for WearOS by Google

    CVE-2025-12080 (GCVE-0-2025-12080)

    Vulnerability from nvd – Published: 2025-10-27 08:45 – Updated: 2025-10-27 15:53
    VLAI
    Title
    Intent Abuse in Google Messages for Wear OS for Silent Message Sending
    Summary
    On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented. Due to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user’s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-345 - Insufficient Verification of Data Authenticity
    Assigner
    References
    Impacted products
    Vendor Product Version
    Google WearOS Affected: 0 , < 30-04-2025 (date)
    Create a notification for this product.
    Date Public
    2025-10-22 22:00
    Credits
    Gabriele Digregorio (Io_no)
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-12080",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-27T15:52:32.763396Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-27T15:53:29.322Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WearOS",
              "vendor": "Google",
              "versions": [
                {
                  "lessThan": "30-04-2025",
                  "status": "affected",
                  "version": "0",
                  "versionType": "date"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:google:wearos:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "30-04-2025",
                      "versionStartIncluding": "0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Gabriele Digregorio (Io_no)"
            }
          ],
          "datePublic": "2025-10-22T22:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eOn \u003cb\u003eWear OS\u003c/b\u003e devices, when \u003cb\u003eGoogle Messages\u003c/b\u003e is configured as the default SMS/MMS/RCS application, the handling of \u003cb\u003e\u003ccode\u003eACTION_SENDTO\u003c/code\u003e\u003c/b\u003e intents utilizing the \u003ccode\u003esms:\u003c/code\u003e, \u003ccode\u003esmsto:\u003c/code\u003e, \u003ccode\u003emms:\u003c/code\u003e, and \u003ccode\u003emmsto:\u003c/code\u003e Uniform Resource Identifier (URI) schemes is \u003cb\u003eincorrectly implemented\u003c/b\u003e.\u003c/p\u003e\u003cp\u003eDue to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to \u003cb\u003esend messages on the user\u2019s behalf\u003c/b\u003e to \u003cb\u003earbitrary receivers\u003c/b\u003e without requiring any further \u003cb\u003euser interaction\u003c/b\u003e or specific \u003cb\u003epermissions\u003c/b\u003e. This allows for the \u003cb\u003esilent and unauthorized transmission of messages\u003c/b\u003e from a compromised Wear OS device.\u003c/p\u003e"
                }
              ],
              "value": "On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented.\n\nDue to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user\u2019s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-502",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-502 Intent Spoof"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-345",
                  "description": "CWE-345 Insufficient Verification of Data Authenticity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-27T08:45:52.604Z",
            "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
            "shortName": "Google"
          },
          "references": [
            {
              "url": "https://towerofhanoi.it/writeups/cve-2025-12080/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Intent Abuse in Google Messages for Wear OS for Silent Message Sending",
          "x_generator": {
            "engine": "Vulnogram 0.4.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "assignerShortName": "Google",
        "cveId": "CVE-2025-12080",
        "datePublished": "2025-10-27T08:45:52.604Z",
        "dateReserved": "2025-10-22T15:24:43.272Z",
        "dateUpdated": "2025-10-27T15:53:29.322Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2025-12080 (GCVE-0-2025-12080)

    Vulnerability from cvelistv5 – Published: 2025-10-27 08:45 – Updated: 2025-10-27 15:53
    VLAI
    Title
    Intent Abuse in Google Messages for Wear OS for Silent Message Sending
    Summary
    On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented. Due to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user’s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-345 - Insufficient Verification of Data Authenticity
    Assigner
    References
    Impacted products
    Vendor Product Version
    Google WearOS Affected: 0 , < 30-04-2025 (date)
    Create a notification for this product.
    Date Public
    2025-10-22 22:00
    Credits
    Gabriele Digregorio (Io_no)
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-12080",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-27T15:52:32.763396Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-27T15:53:29.322Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WearOS",
              "vendor": "Google",
              "versions": [
                {
                  "lessThan": "30-04-2025",
                  "status": "affected",
                  "version": "0",
                  "versionType": "date"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:google:wearos:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "30-04-2025",
                      "versionStartIncluding": "0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Gabriele Digregorio (Io_no)"
            }
          ],
          "datePublic": "2025-10-22T22:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eOn \u003cb\u003eWear OS\u003c/b\u003e devices, when \u003cb\u003eGoogle Messages\u003c/b\u003e is configured as the default SMS/MMS/RCS application, the handling of \u003cb\u003e\u003ccode\u003eACTION_SENDTO\u003c/code\u003e\u003c/b\u003e intents utilizing the \u003ccode\u003esms:\u003c/code\u003e, \u003ccode\u003esmsto:\u003c/code\u003e, \u003ccode\u003emms:\u003c/code\u003e, and \u003ccode\u003emmsto:\u003c/code\u003e Uniform Resource Identifier (URI) schemes is \u003cb\u003eincorrectly implemented\u003c/b\u003e.\u003c/p\u003e\u003cp\u003eDue to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to \u003cb\u003esend messages on the user\u2019s behalf\u003c/b\u003e to \u003cb\u003earbitrary receivers\u003c/b\u003e without requiring any further \u003cb\u003euser interaction\u003c/b\u003e or specific \u003cb\u003epermissions\u003c/b\u003e. This allows for the \u003cb\u003esilent and unauthorized transmission of messages\u003c/b\u003e from a compromised Wear OS device.\u003c/p\u003e"
                }
              ],
              "value": "On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented.\n\nDue to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user\u2019s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-502",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-502 Intent Spoof"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "ADJACENT",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-345",
                  "description": "CWE-345 Insufficient Verification of Data Authenticity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-27T08:45:52.604Z",
            "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
            "shortName": "Google"
          },
          "references": [
            {
              "url": "https://towerofhanoi.it/writeups/cve-2025-12080/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Intent Abuse in Google Messages for Wear OS for Silent Message Sending",
          "x_generator": {
            "engine": "Vulnogram 0.4.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "assignerShortName": "Google",
        "cveId": "CVE-2025-12080",
        "datePublished": "2025-10-27T08:45:52.604Z",
        "dateReserved": "2025-10-22T15:24:43.272Z",
        "dateUpdated": "2025-10-27T15:53:29.322Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }