#android
-
Applebee's app shipped with a database password that exposed customer data
A researcher found hardcoded credentials in Applebee's Android app that allowed anyone to read and modify registered customers' personal data. The flaw has since been fixed.
-
Telegram for Android Flaw Let Attackers Run Code Through a Voice Call
Security startup NebuSec has disclosed a flaw in Telegram for Android: an attacker with an ordinary account only had to call the victim and wait for them to answer. The bug is fixed in version 12.10.4.
-
Google starts certifying third-party Android app stores, but not in the US
Google has opened applications for its Registered App Stores program, which will let approved third-party stores offer Android users easier app installs. The program does not extend to the US.
-
Microsoft Authenticator Flaw on Android Let Permissionless Apps Steal Work Account Tokens
Microsoft has fixed CVE-2026-80097 in Authenticator for Android, which let a malicious app with no permissions pose as Teams and obtain tokens for a work account. Users should update to version 6.2606.4246.
-
Linux Drops Google's C Binder Driver as Rust Version Takes Over "Few Billion Devices"
The char/misc changes for Linux 7.4 remove Google's C-written Binder driver. The Rust implementation now takes over the role for good, destined to run on all future Android devices.
-
Google silently links your phone number across all signed-in accounts
According to Android Authority, Google automatically ties a phone number to the various accounts a user is signed into on a device.
-
Hirudo Android Trojan Swaps Banking Apps for Their Own Patched Copies
ThreatFabric has detailed Hirudo, a new Android trojan that deletes the genuine banking app and installs a pre-patched copy that blinds the app's own security checks from the inside.
-
To report an Android bug, a developer had to disassemble libc
AOSP source releases for recent Android 17 builds lag so far behind what actually ships on devices that a developer had to disassemble libc.so to analyze a regression in bionic.
-
Budget Android Phones Arrive With Malware Already Built Into the Firmware
Bitdefender has uncovered Midnight Mimosa, malware baked into the firmware of cheap Android phones that turns them into residential-proxy nodes and ad-fraud tools.
-
LineageOS 24.0 Arrives on Android 17, Just Shy of a Decade
The LineageOS team has shipped version 24.0 based on Android 17 — and, unusually, ahead of schedule. Highlights include browser-based flashing tools, refreshed apps, and an experimental build for desktop hardware.
-
Pwn2Own Ireland Day Two: Galaxy S26 Falls Three More Times
On the second day of Pwn2Own Ireland 2026, researchers earned $232,500 by demonstrating 45 unique zero-day vulnerabilities. Samsung's flagship was once again the star of the show.
-
Android 17 Locks Accessibility Services to Verified Tools Under Advanced Protection
Google is closing one of the main delivery channels for mobile malware: with Advanced Protection on, only verified apps classified as Accessibility Tools will reach the AccessibilityService API.
-
Challengers Approach: Rival App Stores Land on Google Play
After Epic Games' years-long antitrust fight, Google has begun letting rival third-party app stores be distributed through Google Play. The EFF calls it a win for competition and a chance at more meaningful choice.
-
File Notification Attacks: Side-Channel Leaks on Linux, Android, Windows, and macOS
Researchers in Graz show that subscribing to filesystem change events lets an attacker without read access reconstruct user behavior — from keystroke timing to the list of websites someone visits.
-
OnePlus Leaves Flaws Unpatched as Ordinary Apps Reach Root Without Permissions
A researcher chained two bugs in OnePlus's own software to seize full control of a OnePlus 15. There is still no patch — and the company threatened him with legal action over publishing.
-
F-Droid 2.0: The Biggest App Update in a Decade
The catalog of free Android apps has completely rewritten its official app in Kotlin and Jetpack Compose, overhauling navigation, search and the way apps get installed.
-
Google fined €403 million over location data violations
Ireland's Data Protection Commission has fined Google €403 million for multiple GDPR violations in how it handled users' location data.
-
Meet the first five Googlebooks from Acer, Asus, Dell, HP and Lenovo
Google and its partners have unveiled the first laptops under the Googlebook banner. Five models are up for preorder now and reach stores on October 4th, priced from $899 to $1,299.
-
Android 17 QPR1: New APIs Without Publishing the Source in AOSP
GrapheneOS developers have noted that the latest Android release is the first since version 3.x to add new APIs without releasing them into the open AOSP project.
-
The Linux Kernel Bids Farewell to Binder in C: Rust Wins
The Linux 7.4 kernel is set to remove the old C implementation of Binder. The Rust version will become the sole option for inter-process communication on Android.
- More