Vulnerabilities found in Android data-transfer apps

On October 15, 2026, TU Graz reported on a study of vulnerabilities in Android data-transfer apps. Specialists from TU Graz and the A-SIT center examined apps from seven manufacturers: Google, Samsung, Vivo, Xiaomi, Oppo, Huawei, and Honor.

For data transfer, smartphones usually establish a direct Wi-Fi connection. The researchers found that an attacker within signal range could read or modify the data being transferred. Indoors, the team estimated the attack range at about 20–45 meters; equipment costing less than 100 euros was enough to eavesdrop on a transfer.

During testing, the researchers were able to obtain SMS messages, contacts, photos, medical information, credentials for accessing saved Wi-Fi networks, and app passwords. In some cases, manipulating app packages made it possible to install malware on a new smartphone.

The manufacturers were notified of the vulnerabilities in advance. By the time TU Graz published its report, all seven companies had provided security updates. The researchers recommend installing the latest app versions on both smartphones and the necessary system updates before transferring data; in some cases, the operating system will need to be updated.

Image: NOTE PHONE & Google CC BY 3.0 · License

Translation editors: Соловьев В., Пеков А.