The vulnerability arises from the inclusion of Google API keys in the decompiled code of Android applications. Attackers can extract dozens of these keys, which grant access to all Gemini endpoints associated with the keys. This exposure allows unauthorized parties to interact with these endpoints, potentially compromising backend services. No specific affected versions or patches are identified, and this is not a cloud service vulnerability. No known active exploitation has been reported.

Unauthorized access to Gemini endpoints via extracted Google API keys could lead to exposure or misuse of backend services. The exact impact depends on the permissions granted by the keys and the sensitivity of the data or operations accessible through the Gemini endpoints. No direct evidence of exploitation or data breach is reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, developers should avoid embedding sensitive API keys directly in app code. Employing secure key management practices, such as using backend token exchange or restricted API key scopes, is recommended to reduce exposure risk.