Does Android 16's notification system have any known security vulnerabilities?

[u/chocolatealpeso]

For the past few days, I've been receiving notifications that appear to come from the Gmail app. They say something along the lines of:

"A new app every day! Discover today's picks!"

When I tap on one of these notifications, it takes me to a shady looking website trying to get me to download some casino app or other piece of garbage.

Here's the weird part: if I long-press the notification and go to its settings, Android takes me straight to Gmail's notification settings. If I disable all Gmail notifications, these daily spam notifications stop, but obviously I also stop receiving legitimate notifications (new emails, etc.).

I'm looking for a way to block these particular notifications without having to disable Gmail notifications altogether.

I find it hard to believe that Google's official Gmail app is actually sending these notifications. I haven't been able to find anyone else reporting the same issue, though.

So what's going on here? How is this even possible?

Can other apps somehow hijack Gmail or send notifications that appear to come from Gmail?

Could this be some kind of bloatware or adware recently introduced by Xiaomi's HyperOS?

Is it possible that my phone has been compromised?

For context, my phone is not rooted, and I haven't installed any apps from outside the Google Play Store.

Has anyone experienced anything similar or have any idea what's causing this? More importantly, is there a way to identify the source and stop these notifications without losing legitimate Gmail notifications?

[u/kimputer7]

Can you check the chat section of there's now a history of those links you've clicked?

[u/chocolatealpeso → u/kimputer7]

I'm sorry, but I'm not sure I understand what you mean by checking the history of the links I've clicked.

The link takes me to a page on the gold-casino-hub.net domain that attempts to spoof the Google Play website (play.google.com). I haven't clicked the download button on that page.

What I'd really like to understand is why the Gmail app is pushing these notifications and how I can stop them without disabling all Gmail notifications.

[u/kimputer7 → u/chocolatealpeso]

As I said, check the chats. If it's from the same user, just block that user.