Oversecured Apps Care. Part 1: Vulnerability disclosure of 225 Google apps | Oversecured Blog

What it is

Oversecured's "Oversecured Apps Care, Part 1" (posted 21 March 2024) lists automated scanner output for Google Android apps across five emulator images. It is a lead list for bug hunters, not a set of confirmed vulnerabilities. Oversecured says the scan covered 6,000+ public APKs from 1,000+ companies and that this part covers 224 Google apps. It runs the work as a bi-annual program, and its scanner combines static (SAST) and dynamic (DAST) analysis.

Preconditions / Affected

The scans ran on emulator images, not shipping device firmware. The fingerprints on the page are:

• Phone: sdk_gphone64_arm64, a user/release-keys build labelled UpsideDownCakePrivacySandbox.
• Wear OS: sdk_gwear_arm64, Android 14, userdebug/dev-keys, build AW2A.240422.007.E8.
• Automotive: sdk_gcar_arm64, Android 14, userdebug/dev-keys, build UEA1.240910.001.
• Second phone-class table: sdk_gpc_arm64, Android 14, userdebug/dev-keys, build UE2A.240712.001.
• Android TV: sdk_google_atv64_arm64, Android 14, user/dev-keys, build UTT1.240131.001.F1.

Some of these build IDs are dated April and September 2024, after the 21 March 2024 post date, so the tables appear to have been updated since publication. Findings on userdebug builds may not apply to production devices.

Largest counts

Each row shows three numbers per package, in the format x/y/z. The page never says what they mean, so any severity reading is a guess. Highest rows in the phone table:

In the Wear OS table, android is 161/402/316 and com.android.providers.contacts is 64/49/30. The same contacts and telephony providers recur on the car, phone-class and TV images with similar counts, which suggests shared AOSP code is being flagged repeatedly.

What to do

Use the per-package report links to triage, then report anything you can confirm through the Google link the post points to. The page offers these reports as a route to Google rewards. It does not describe any specific exploit, and the report contents were not available in the fetched text.

Caveats

• Counts are raw scanner statistics. The page gives no severity key, no false-positive rate and no confirmed-bug tally.
• The tables have defects: com.google.android.apps.translate appears twice (rows 121 and 122, counts 3/32/36 and 3/33/36), some rows have no package name, and several names contain stray spaces.
• The count of 224 apps does not obviously match the table rows. The phone table alone lists 206 packages, and the other images overlap heavily.
• Oversecured promotes its paid scanner on the page, including a free 2-week QuickStart trial.