Joe Maring / Android Authority
TL;DR
- A bug in Android notifications can cause the “Open link” button to open a different link than the one displayed.
- Hidden characters in the messages can confuse the system, causing it to open a link that only makes up a part of the one in the displayed notification.
- Until Google issues a fix, it’s safest to avoid using the “Open link” button and open links manually in the app.
You might want to think twice before tapping that link in your Android notifications, even if it looks safe. A newly discovered bug means that the link you see in the notification might not be the one you’re actually opening, and the potentially dangerous consequences are apparent.
In a clear and detailed blog post, Security researcher Gabriele Digregorio lays out how Android’s “Open link” button — the one that shows up in notifications from apps like WhatsApp, Instagram, or Slack — can be manipulated to send users to a completely different website than the one shown. The trick involves inserting hidden Unicode characters into a message, which can fool Android into reading the text differently when deciding which part of the notification text is the link.
For example, the system might show you a link to Amazon.com, but when you tap “Open link,” it subtly takes you to zon.com instead. That’s exactly what happened in one test, where an invisible character was used to split the word into two. Android displayed the full address in the notification as if it were legit, but treated only the second part (zon.com) as the actual link. Digregorio demonstrates this example in the YouTube video below.
It’s easy to see how this could be used to trick people into visiting phishing sites, or even to trigger actions inside apps via deep links. One example in Digregorio’s report shows a WhatsApp link that opens a chat with a preset message. This is a legitimate WhatsApp feature, but it’s potentially risky if used deceptively. In theory, apps should always ask for confirmation before carrying out any action triggered by a link. However, some don’t, which means tapping the wrong link could launch something instantly.
Google was notified about the bug in March but hasn’t patched it yet. In correspondence with the researcher, Google assessed the issue as moderate severity, which appears to mean it will be addressed in a future update, but doesn’t warrant a separate and immediate security patch. At the time of the blog’s publication on Wednesday, the issue still affected phones running Android 14, 15, and 16, including the Pixel 9 Pro. iPhones behave differently, highlighting suspicious links more clearly, but similar tricks are technically possible.
Until a fix arrives, the safest option is to avoid tapping these notification-generated links altogether. If something looks important, open the app directly instead, and double-check any links before you visit them.
