GitHub Security Lab on Mythryl: “A zero-permission Android app could read every photo, video, voice…”

@securitylab.github.com

A zero-permission Android app could read every photo, video, voice note, and document in your Signal chats. Downloaded Signal apk directly from Signal.org? You were vulnerable. securitylab.github.com/advisories/G...

securitylab.github.comGHSL-2026-102: Unauthorized exfiltration of decrypted attachments in Signal through Intent redirectionVersions >= v6.38.0 and < v8.4.2 of the website flavor of Signal for Android (distributed at https://signal.org/android/apk) allows another installed app without any permissions to exfiltrate decrypte...

3/4/26, 8:01 pm3 reposts4 likes

Post