Oversecured, a company specializing in mobile app security assessments, has unearthed a trove of vulnerabilities affecting Android apps from both Xiaomi and Google’s Android Open Source Project (AOSP). The revelations come as a stark reminder of the persistent threats lurking within the mobile ecosystem, with implications for millions of users worldwide.

According to Oversecured’s findings, more than two dozen vulnerabilities have been identified over the past few years, posing significant risks to users’ data security and privacy. Of particular concern are the 20 vulnerabilities reported to Xiaomi a year ago, which have since been addressed by the smartphone manufacturer. Xiaomi emphasized its commitment to user security, stating that all reported vulnerabilities have been remediated to ensure no users are left exposed to potential risks.

Among the vulnerabilities uncovered by Oversecured are flaws that could grant unauthorized access to system privileges, facilitate theft of sensitive files, and expose users’ personal data, including phone numbers and account information. The vulnerabilities span across various Xiaomi applications and system components, highlighting the breadth and severity of the security lapses identified.

Notably, several of the vulnerabilities stem from modifications made to AOSP code by Xiaomi, underscoring the complexities inherent in customizing Android’s open-source framework. For instance, the System Tracing app, originally derived from AOSP, was found to contain a shell command injection vulnerability resulting from Xiaomi’s custom modifications.

Similarly, modifications to the Settings app and Phone Services app introduced vulnerabilities that could leak sensitive information and expose telephony data, respectively. These findings shed light on the challenges faced by manufacturers in maintaining the integrity and security of their custom Android builds, while also raising questions about the oversight and quality assurance processes involved in the modification process.

In addition to vulnerabilities affecting Xiaomi, Oversecured also identified six vulnerabilities in Google’s AOSP code, including two specific to Pixel devices. These vulnerabilities, if exploited, could enable attackers to access sensitive user data, manipulate carrier settings, and bypass VPN protections, posing significant risks to user privacy and device security.

The revelation of these vulnerabilities underscores the critical importance of ongoing security assessments and rigorous testing practices in safeguarding mobile devices against emerging threats. As the mobile landscape continues to evolve, manufacturers and developers must remain vigilant in identifying and addressing vulnerabilities to ensure the safety and privacy of users worldwide.