Researchers say preinstalled Android apps can access a log where sensitive contact tracing app information is stored; Google says a fix is being rolled out
Researchers say hundreds of preinstalled apps can access a log found on Android devices where sensitive contact tracing information is stored
Context & Ripple Effects
The finding lands three months after Google began urgently investigating problems with Exposure Notifications apps — so this is the second time in a quarter that the COVID-19 contact tracing stack on Android has needed Google's direct intervention. It also fits a longer pattern on the platform: researchers previously flagged [[a:938653|17K Android apps, some with 100M+ installs, collecting enough device activity for permanent ad profiles]], and earlier found bugs in Google and Samsung camera apps that let unauthorized code capture video and GPS without permission.
What makes this episode distinct is where the leak sits: not in third-party Play Store apps but in the preinstalled layer, which users cannot uninstall and rarely see. A fix being rolled out server-side by Google is the mitigation; the exposure itself was systemic to how Android partitions privileged logs.
First-order effects
- Hundreds of preinstalled apps on Android devices had read access to a system log containing sensitive contact tracing information, meaning exposure risk applied to anyone using an Exposure Notifications-based health app regardless of which app they installed.
Second-order effects
- Health authorities running contact tracing programs face renewed adoption friction: every new disclosure about the Android stack gives hesitant users another reason to leave Exposure Notifications off, undercutting the opt-in data these programs depend on.
Third-order effects
- If preinstalled apps keep turning up as the weak link — camera apps, now this log — pressure will build on Google to restrict what system-level apps can read by default rather than patching individual leaks, a shift in how the Android permission boundary treats OEM software it does not fully control.
The trend: Android's recurring security disclosures are converging on one structural weakness: the privileged preinstalled-app layer sits outside the permission model users are asked to trust.