Credit: Joe Maring / Android Authority
- A bug in Android notifications can cause the “Open link” button to open a different link than the one displayed.
- Hidden characters in the messages can confuse the system, causing it to open a link that only makes up a part of the one in the displayed notification.
- Until Google issues a fix, it’s safest to avoid using the “Open link” button and open links manually in the app.
Update, June 13, 2025 (5:19 PM ET): Google has reached out to Android Authority with a comment on this researcher’s findings. A spokesperson tells us:
We are aware of this research and we are actively working on a fix for this issue that will be rolling out in a future security update. As general best security practice, we always advise users to avoid clicking on links from unknown or suspicious message senders.