NVD - cve-2025-12080

nvd.nist.gov • July 4, 2026

This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.

On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented. Due to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user’s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2025-12080: Intent Abuse Vulnerability in Google Messages for Wear OS CVE-2025-12080 affects Wear OS devices where Google Messages is the default SMS/MMS/RCS app. The vulnerability arises from improper handling of ACTION_SENDTO intents, allowing attackers to send messages on behalf of users without interaction or permissions. This silent message transmission can target arbitrary receivers, posing a significant risk to user privacy and security. The flaw is linked to CWE-345, indicating insufficient verification of data authenticity. A public proof-of-concept exploit is available on GitHub, highlighting the potential for active exploitation. The vulnerability was published on October 27, 2025, and remains a concern for users of affected Wear OS devices. Security professionals are advised to monitor for updates and potential mitigations. 2 sources 55

Extracted Entities

CVEs (1)

CVE-2025-12080

Platforms (2)

Android Wear OS