CITT

    Scan results

    Google

    Android

    The Google app offers AI-powered search, Google Lens, Circle to Search, voice commands, and personalized news discovery. Features include AI Mode for answering questions, real-time updates on interests, and access to generative AI with Gemini.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Google users comfortable with broad data collection

    Not For: You want to limit Google from profiling your activity

    What It Means For You

    Searches, voice queries, and browsing activity are collected and linked to the user's Google profile. This behavior is shared with Google Analytics and Google Ads to build an advertising profile. Meta-developed components are embedded in the app, meaning usage patterns flow through additional third-party infrastructure.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (17)

    Data Security

    3 total
    1 Critical
    1 High
    1 Medium

    Network Security

    3 total
    1 High
    2 Medium

    Code Security

    5 total
    2 High
    3 Medium

    Privacy

    5 total
    2 High
    1 Medium
    2 Low

    Third-Party Risk

    1 total
    1 Medium

    Third-Party Services

    Firebase, Google Analytics, Google Ads, Lottie (Airbnb), Glide (Bumptech), Litho (Meta), Yoga (Meta), Google Play Services

    Security Strengths

    • ✓Heavy ProGuard/R8 obfuscation (101,258 classes)
    • ✓OAuth tokens securely managed via Account Manager
    • ✓SQL injection prevention via Room ORM
    • ✓No SSL/TLS validation bypasses
    • ✓No third-party analytics SDKs (first-party only)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    search
    voice
    location
    camera
    contacts
    sensitive data
    ads
    social

    Package

    com.google.android.googlequicksearchbox

    Version

    17.3.60.ve.arm64 (301684842)

    Analysis Date

    Jan 30, 2026

    Classes Analyzed

    101,258

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 critical, 1 high, 1 medium)

    Network Security - 3 findings (1 high, 2 medium)

    Code Safety - 0 findings

    Privacy - 5 findings (2 high, 1 medium, 2 low)

    Privacy Concerns

    What Data is Collected

    Search queries, voice commands, browsing activity, and usage patterns are collected each time the app is used. Device identifiers and location signals are gathered to personalize search results and build an advertising profile linked to the user's Google account.

    Third-Party Data Sharing

    Activity data flows to the following third parties:

    • Firebase - App analytics and crash reporting
    • Google Analytics - Behavioral tracking and usage analysis
    • Google Ads - Advertising targeting and measurement
    • Litho (Meta) - UI framework with Meta infrastructure
    • Yoga (Meta) - Layout engine with Meta infrastructure
    • Lottie (Airbnb) - Animation rendering
    • Glide (Bumptech) - Image loading
    • Google Play Services - Core Google platform integration

    Understanding the Scores

    ScoreValue
    Security45/100
    Privacy35/100
    Data Security40/100
    Network Security60/100
    Code Safety50/100
    Data Collection25/100
    Data Sharing45/100
    User Control40/100

    Positive Security Features

    • None identified.

    Areas for Improvement

    • Limit behavioral data collection to what is needed for search, rather than building an advertising profile across all user activity.
    • Provide clearer in-app controls so users can adjust what data is shared with advertising and analytics services.
    • Reduce reliance on Meta-developed frameworks that route usage patterns through additional corporate infrastructure.

    About This Analysis

    This report is based on automated static analysis of the app's code and configuration. It reflects the state of the app at the time of the scan and may not capture runtime behavior.

    App Details

    FieldValue
    App NameGoogle
    Package IDcom.google.android.googlequicksearchbox
    Version17.3.60.ve.arm64 (301684842)
    Scan Date2026-01-30
    PlatformAndroid

    Right of Reply

    Developer not yet contacted