Google API Keys in Android Apps Expose Gemini Endpoints to Unauthorized Access

2026-04-10

Hardcoded Google API keys in Android apps now authenticate to Gemini, exposing developer resources on Gemini and any uploaded user content. Attackers can pull keys from decompiled APKs, access cached files and documents, make arbitrary Gemini calls, and burn through quotas.