CVE-2025-12080

On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented. Due to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user’s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device.

CVSS

No CVSS.

References

Link	Resource
https://towerofhanoi.it/writeups/cve-2025-12080/

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) En dispositivos Wear OS, cuando Google Messages está configurada como la aplicación predeterminada de SMS/MMS/RCS, el manejo de intents ACTION_SENDTO que utilizan los esquemas de Identificador Uniforme de Recursos (URI) sms:, smsto:, mms: y mmsto: está implementado incorrectamente. Debido a esta configuración incorrecta, un atacante capaz de invocar un intent de Android puede explotar esta vulnerabilidad para enviar mensajes en nombre del usuario a destinatarios arbitrarios sin requerir ninguna interacción adicional del usuario o permisos específicos. Esto permite la transmisión silenciosa y no autorizada de mensajes desde un dispositivo Wear OS comprometido.

Information

Published : 2025-10-27 09:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-12080

Mitre link : CVE-2025-12080

CVE.ORG link : CVE-2025-12080

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2025-12080", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12080", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:52:32.763396Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@google.com", "affectedData": [{"vendor": "Google", "product": "WearOS", "versions": [{"status": "affected", "version": "0", "lessThan": "30-04-2025", "versionType": "date"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-27T09:15:36.040", "references": [{"url": "https://towerofhanoi.it/writeups/cve-2025-12080/", "source": "cve-coordination@google.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented.\n\nDue to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user\u2019s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device."}, {"lang": "es", "value": "En dispositivos Wear OS, cuando Google Messages est\u00e1 configurada como la aplicaci\u00f3n predeterminada de SMS/MMS/RCS, el manejo de intents ACTION_SENDTO que utilizan los esquemas de Identificador Uniforme de Recursos (URI) sms:, smsto:, mms: y mmsto: est\u00e1 implementado incorrectamente.\n\nDebido a esta configuraci\u00f3n incorrecta, un atacante capaz de invocar un intent de Android puede explotar esta vulnerabilidad para enviar mensajes en nombre del usuario a destinatarios arbitrarios sin requerir ninguna interacci\u00f3n adicional del usuario o permisos espec\u00edficos. Esto permite la transmisi\u00f3n silenciosa y no autorizada de mensajes desde un dispositivo Wear OS comprometido."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "cve-coordination@google.com"}