Researchers from Check Point have found that some popular apps are still operating the outdated versions of Google’s Play Core library for Android versions that carried a remote file insertion vulnerability.
According to security experts, nearly 8% of Android apps available on the official Google Play Store are exposed to a security flaw in a famous Android library.
Google patched the vulnerability in April before it has been disclosed publicly; the cybersecurity researchers of Check Point discovered in recent research that it was still present in some Android apps. The apps like Cisco Teams, and there are also some dating apps such as Grindr, OkCupid, and Bumble, and exploration app Moovit among others.
.png
)
However, this kind of vulnerability enables a threat actor to insert a malicious code into vulnerable applications, just by allowing access to all the same sources on the user’s phone as the hosting application.
Apps utilize this library
According to the report that has been asserted by the experts, there are many popular applications that utilized this library, and here they are mentioned below:-
- Google Chrome
- Snapchat
- Booking
- Edge
CVE-2020-8913
The vulnerability, CVE-2020-8913, was initially uncovered in August by the experts at Oversecured. The experts found that the Play Core Library, which has an in-app update and streamlining feature that are offered to Android devices.
It could be exploited to “add executable modules to any apps using the library.” This vulnerability has a sandbox, and inside it, there are two folders, one for “verified” files initiated from Google Play, and the other one is for “non-verified” files.
Some other features have exported plan, enables other sources to push files into the hosting application’s sandbox. Moreover, this vulnerability also has some limitations, like the file is pushed into the non-verified folder, and the library is controlled automatically.
Apps Discovered by Experts from a Large Variety of Genres
- Social – Viber
- Travel – Booking
- Business – Cisco Teams
- Maps and Navigation – Yango Pro (Taximeter), Moovit
- Dating – Grindr, OkCupid
- Browsers – Edge
- Utilities – Xrecorder, PowerDirector
However, the Android app developers who use Google’s Play Core Library are advised to update Play Core to version 1.7.2 or later. Android users should also reconsider installing security software on their devices.
Apart from this, users will find many famous and reliable security apps in Google Play from various well-known and trustworthy vendors.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Also Read:
Hackers Bypass App Store Protection to Launch Fitbit Spyware that Steal Data From Watch Face
