A preferred Android browser app with greater than 5 million downloads on the Google Play Retailer might have been leaking person knowledge together with browser historical past, specialists have claimed.

Cybernews (opens in new tab) says it found that the ‘Internet Explorer – Quick Web’ app had left its Firebase occasion open – a cellular utility improvement platform that’s designed to help with analytics, internet hosting, and cloud storage. 

In danger is 5 days’ value of redirect knowledge, together with nation, direct initiating tackle, redirect vacation spot tackle, and person nation, all introduced by person ID.

Android Internet Explorer knowledge leak

Cybernews senior journalist Vilius Petkauskas, explains that getting their arms on this knowledge alone will not be sufficient to offer menace actors what they search, nonetheless cross-referencing it with further particulars might show dangerous.

The app was additionally discovered to be hardcoding on the shopper aspect, together with keys referring to anonymized partial person shopping historical past, distinctive public identifiers, and a cross-server communication enabler.

“If menace actors might de-anonymize the app’s customers, they’d be capable to examine a bunch of data on shopping historical past for a selected person and use it for extortion,” CyberNews famous.

It has since been found that the open Firebase occasion has been closed and is not accessible, which signifies that menace actors can not entry delicate knowledge. Nevertheless, it’s not all excellent news: Cybernews reached out to the app’s staff about its findings, however it’s but to obtain a reply.

Additional digging additionally uncovers that the app was final up to date in October 2020, that means that the hardcoded ‘secrets and techniques’ are possible nonetheless there. The researchers write: “…we will solely guess what different data may very well be leaking by means of the appliance’s secrets and techniques”.

• Safe your knowledge with the most effective ID theft safety