Google Messages CVE-2025-12080

Three concrete conditions must all hold: (1) the target is a Wear OS device; (2) Google Messages is configured as the default SMS/MMS/RCS application on that device; and (3) the attacker can invoke an Android intent on the device - realistically meaning a malicious or compromised app is already present. Given those, the ACTION_SENDTO handler for the sms:/smsto:/mms:/mmsto: URI schemes sends messages without requiring SMS permissions and, per the description, without further user interaction. LIMITING FACTORS: exploitation is confined to the Wear OS platform and the non-universal condition that Google Messages is the default messaging app, and it requires an existing on-device foothold rather than remote network access; the vendor vector also marks UI:P (passive interaction), which, if accurate, further constrains a fully silent attack.

Signals are internally consistent toward a MEDIUM, low-urgency rating. The input CVSS 4.0 base score is 6.9 (Medium) with AV:A/AC:L/PR:N/UI:P and the primary impact on integrity (VI:H, SI:L) rather than confidentiality or availability - the flaw lets an attacker forge/send messages, not read data or crash the device. EPSS corroborates low real-world urgency: 0.14% probability at the 3rd percentile, meaning predicted exploitation is very unlikely. There is no CISA KEV listing and no explicit POC flag in the input, so exploitation status is: no public exploit identified at time of analysis (note: the sole reference is a third-party technical writeup that may contain exploit detail, but no POC signal was provided). The practical limiter is that exploitation is not remote-internet-facing: the attacker must already be able to invoke an Android intent on the watch - typically via a malicious or compromised app on the device - so a foothold is a prerequisite. CONFLICT TO VERIFY: the description states the attack succeeds 'without requiring any further user interaction,' yet the vendor CVSS vector encodes UI:P (passive user interaction required). This discrepancy should be verified with Google; it modestly affects how 'silent' the attack truly is. Overall this is a legitimate but moderate issue - a privilege/authorization gap exploitable only after an attacker controls or installs software on a specific device class - not a high-urgency, mass-exploitation priority.

A malicious or compromised application running on a Wear OS watch that has Google Messages set as the default SMS/MMS/RCS app invokes an ACTION_SENDTO intent using an sms:, smsto:, mms:, or mmsto: URI. Because the intent handler does not properly verify authorization, Google Messages transmits the attacker-specified message to arbitrary recipients silently, without prompting the user and without the attacker holding SMS permissions. No public exploit was identified in the provided data, though a third-party technical writeup of the issue exists.