Case gemini-gmail-summary-phishingPrompt injectionUnited States
Hidden email text makes Gemini for Workspace summaries deliver fake security alerts
Mozilla 0din's Marco Figueroa showed white-on-white or zero-size text in an email could make Gemini's Summarize this email feature append a fake Google warning with an attacker phone number. Google acknowledged it.
MediumAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 10, 2025
- Location
- United States
- Target
- Google Gemini for Workspace (Gmail summaries)
- Severity
- Medium
- Triggered by
- Marco Figueroa (Mozilla 0din)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Mozilla 0din's Marco Figueroa showed white-on-white or zero-size text in an email could make Gemini's Summarize this email feature append a fake Google warning with an attacker phone number. Google acknowledged it.
Impact: Enables phishing that bypasses spam filters by riding on trusted AI summaries; no abuse confirmed
Who triggered it
Actor: Marco Figueroa (Mozilla 0din)
Attribution: Disclosed through Mozilla's 0din GenAI bug bounty programme
Motive: Security research
How it happened
Attack vector: Indirect prompt injection via hidden HTML and CSS in email body; no links or attachments needed
Root cause: Summariser treated hidden email content as instructions
Timeline
- 0din publishes the proof of concept
- Google says it runs red-teaming and has deployed defences
Response
Google acknowledged the issue and cited layered prompt-injection mitigations
Current status: Contained
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- Tom's Hardware tomshardware.com
Cite this case
Hidden email text makes Gemini for Workspace summaries deliver fake security alerts. AI Threat Watch, case gemini-gmail-summary-phishing, Jul 10, 2025. https://aithreat.io/cases/gemini-gmail-summary-phishing/
Permanent link: https://aithreat.io/cases/gemini-gmail-summary-phishing/