Popular dating apps like Bumble, OkCupid are at risk

Grindr, Bumble, OkCupid, Cisco Teams, Yango Pro, Edge, Xrecorder, PowerDirector, and many other popular apps are still vulnerable due to a flaw in the Play Store’s core library. The vulnerability affects hundreds of millions of users worldwide, despite Google releasing a fix in April.

According to a Check Point report, the bug that Google had fixed in April 2020 is still affecting many apps, and the app developers have not fixed the flaw on their end yet. Many app developers are still using the outdated version of Google Core Library (GPC), a library that enables in-app updates and other features.

The researchers at Check Point randomly tested some of the popular Google Play Store apps and found that 13 percent of them were using GPC, and 8% of them were still using the vulnerable version. Google rated the flaw severity at an 8.8 on 10.

The vulnerability is limited to Android phones because they leverage Google Play Services, while apps on iOS are completely safe.

The vulnerability is called CVE-2020-8913, and millions of users are at potential risk of a cyber attack. Its ramifications are severe as it can steal 2FA SMS codes, inject code into a banking app, snoop on instant messengers, and even tamper with enterprise apps.

The development teams behind some popular apps like Viber, Meetup, Cisco, Grindr, Moovit, Cisco Teams, and Booking.com have updated the library in their apps after being notified by Check Point. Viber and Booking have now updated to new patched versions, but the other apps have not yet.

There isn’t much you can do as a user since the issue originates from the developer. Ensure all your apps are always updated because the fix shall drop soon.