Go SMS Pro, an Android messaging app with 100M+ installs, is exposing photos, videos, and other files sent privately by its users
Go SMS Pro, one of the most popular messaging apps for Android, is exposing photos, videos and other files sent privately by its users. Worse, the app maker has done nothing to fix the bug.
Context & Ripple Effects
Go SMS Pro is the latest entry in a recurring pattern on Android: hugely installed messaging and utility apps shipping with security holes that expose user data. The lineage runs from Samsung's Messages app randomly sending photos to contacts in 2018, through VidMate secretly subscribing its 500M-install base to paid services, to JusTalk leaving millions of conversations exposed in a plaintext database.
What distinguishes this case is the response: the corpus notes Go SMS Pro's maker has not fixed the vulnerability, so every one of its 100M+ installs remains exposed indefinitely rather than patched after disclosure.
First-order effects
- Users who sent photos, videos, or other files as private messages have no fix available — their shared media stays exposed until the developer acts, since the flaw sits in the app itself rather than the OS.
- Go SMS Pro's maker now owns an unpatched disclosure on a flagship product, converting a routine bug report into a trust and liability problem across its entire install base.
Second-order effects
- Google Play comes under renewed pressure to police high-install apps for data-exposure flaws, following the same scrutiny that hit the Play catalog when researchers found 50+ apps charging users via premium SMS numbers.
- Rival messaging apps can pitch end-to-end protection against exactly this failure mode, making 'your files are exposed by default' a competitive wedge against SMS-replacement apps.
Third-order effects
- If unpatched disclosures keep landing on top Android apps, enforcement will likely shift from developer goodwill toward platform-level requirements — mandatory security response timelines or store-level takedowns — reshaping how the Android long tail maintains its software.
- The pattern also strengthens the case for regulators treating consumer-app data exposure as a systemic market failure rather than isolated incidents, given how many large-install offenders the record already shows.
The trend: Android's security frontier is shifting from the operating system to the long tail of hundred-million-install third-party apps whose developers leave known data exposures unfixed.