Loading story…
A bug in the Phone by Google app’s “Take a Message” feature can unintentionally transmit a Pixel user’s background audio to a caller while the caller is leaving a voicemail-like message after a missed or declined call. Reports describe the experience as if the call were partially answered: the caller can hear the phone’s surroundings, while the Pixel user cannot hear the caller; in at least one case, the microphone privacy indicator (green dot) appeared when the feature activated. The issue appears to affect a small number of users and is reported most often on older Pixel models (e.g., Pixel 4a/5), though at least one report involved a newer device.
The issue was initially surfaced via user reports on Reddit and was subsequently covered by 9to5Google and ZDNET, which note that users were able to reproduce the behavior and that disabling Take a Message stopped the leakage in at least one case. As a mitigation, guidance is to turn off “Take a Message” in the Phone app settings until Google provides a fix; the feature was rolled out broadly to Pixel 4 and newer in select regions (including the US, UK, Ireland, and Australia) after being introduced with Pixel 10.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
ZDNET reported the same Pixel 'Take a Message' issue, noting additional user discussion on Reddit and that at least one Pixel 10 user had also reported the behavior. ZDNET said it contacted Google for more information and recommended turning off the feature pending clarification or a fix.
9to5Google published details of the privacy-impacting bug, explaining that the 'Take a Message' feature might transmit a callee's background audio to a caller leaving voicemail-like messages. The outlet advised users to disable the feature as a mitigation while Google investigated.
By the time the issue was reported publicly, Google said it was aware of the Pixel 'Take a Message' bug reports and was actively investigating the potential unintended microphone activation. Independent testing by 9to5Google and ZDNET did not reliably reproduce the behavior, suggesting it was not widespread.
At least six user reports dating back to September 2025 described a privacy bug in Google's Pixel Phone app in which callers leaving a message could hear ambient audio from the callee's surroundings after a missed or declined call. Reports were concentrated on older Pixel models, though later accounts included newer devices as well.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcezdnet.com
Open source9to5google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released a November feature update for Pixel phones, introducing several new capabilities focused on user security and convenience. Notably, the update adds scam detection for messages, which alerts users to potentially fraudulent communications, and notification summaries to help users manage important messages. These features are rolling out to Pixel 6 and newer devices, aiming to enhance protection against social engineering attacks and improve overall user experience. Separately, security researchers have disclosed a critical Android vulnerability known as Pixnapping (CVE-2025-48561), which allows malicious apps to capture screenshots of sensitive information without requiring special permissions. This flaw potentially exposes passwords, one-time codes, and financial data to attackers, affecting all modern Android devices, including those running the latest versions. While Pixnapping is not yet exploited in the wild, it underscores the ongoing risks to mobile device security and the need for prompt patching by Google.
Jun 29, 2026
Google is rolling out its September 2026 Pixel Drop to Pixel 6 and later devices, expanding the Pixel VIPs home-screen widget with one-tap calling and texting for frequently contacted people. The streamlined VIP layout may revert when users add more than four contacts. The update also extends **Scam Detection** to Gboard, warning users when they begin drafting replies to suspicious messages in messaging apps. Google said the detection operates locally and in real time, keeping message analysis on the device rather than sending conversation content to its servers.
Sep 17, 2026
Google said it is rolling out a fix for an Android 16 lock-screen bypass in **Gemini** that allows someone with brief physical access to a locked phone to send **SMS** and **WhatsApp** messages without entering a PIN, password, or biometric. Researchers and follow-on reporting said the flaw can be triggered through a specific multi-touch interaction when Gemini is invoked from the lock screen and prompted to open apps such as Messages, bypassing the expected authentication step. Google said the issue is not limited to Pixel devices, though it did not identify all affected manufacturers or models. The bug was reproduced on a fully patched **Pixel 6a** and appears tied to Gemini's **Deep Research** and lock-screen app-handoff behavior, where authentication checks can fail during transitions from the lock-screen overlay into the full app. Reporting said the weakness may also let an attacker regain Gemini access to previously disconnected apps, switch accounts, view or delete Gemini conversation history, change some security settings, and exfiltrate data while leaving no failed unlock attempts logged. The researcher who disclosed the issue said it reflects an incomplete fix for an earlier reported vulnerability and points to a broader trust-boundary problem in how lock-screen restrictions are enforced across Gemini activities.
Jul 21, 2026