Scan results

Recommendation: Acceptable with Awareness

Generally safe for Xbox users on standard, unmodified devices. The two areas worth knowing about are how your account authentication key is stored and the potential for passive screen recording by the crash-reporting service. Neither issue poses an everyday risk for the vast majority of users, but they are worth understanding if you use this app on a modified device or have privacy concerns about screen activity being shared with third parties.

Key Findings

Data Security - 2 findings (1 medium, 1 info)

Network Security - 2 findings (1 low, 1 info)

Code Safety - 1 finding (1 low)

Privacy - 5 findings (1 low, 4 info)

Privacy Concerns

What Data is Collected

• Account information: Xbox Live account identifiers, session data
• Device information: device identifiers, push notification tokens, crash diagnostics
• Usage data: app interactions, game library activity, party and chat activity
• Location data: approximate and precise location (used for console Wi-Fi setup and pairing)
• Microphone audio: used for party voice chat (a core disclosed feature) and local sound-level detection only

Third-Party Data Sharing

The following third parties may receive your data:

• Sentry - crash reporting and potential screen recording of in-app activity
• Microsoft AppCenter - crash reporting and diagnostic telemetry
• Microsoft 1DS (OneDS) - first-party diagnostic and session telemetry sent to Microsoft servers
• Firebase (Google) - push notification delivery and basic crash metrics
• Google ML Kit - on-device barcode scanning for console pairing (no data leaves the device)

Understanding the Scores

Security: 93/100

Privacy: 95/100

Security Breakdown

• Data Security: 93/100 - Strong overall, with one area where an authentication key is stored without hardware-backed protection
• Network Security: 97/100 - All Xbox Live cloud traffic uses encrypted connections; a small number of legacy configuration entries allow unencrypted local network connections for console pairing
• Code Safety: 96/100 - Code obfuscation is active; one minor issue with unvalidated custom URL scheme handling

Privacy Breakdown

• Data Collection: 99/100 - Data collection is well-scoped to core features; location and microphone use are tied to disclosed functionality
• Data Sharing: 98/100 - First-party telemetry goes to Microsoft; Sentry receives crash data and potentially screen recordings
• User Control: 99/100 - Microsoft provides data deletion options and a clear privacy policy

Positive Security Features

• Backup of sensitive app data via Android backup channels is disabled, preventing extraction by backup tools
• A modern TLS library (Conscrypt) is bundled so the app uses up-to-date encrypted connections regardless of the Android version installed on your device
• No custom SSL bypass or weakened connection verification was found
• Web content inside the app is configured securely: local file access is disabled, mixed content is blocked, and debugging is disabled in production builds
• Connection errors are handled by cancelling the request rather than silently proceeding
• All Xbox Live cloud API traffic uses encrypted connections exclusively
• Code obfuscation is enabled, making reverse engineering significantly harder

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Screen Recording Disclosure
   The Sentry session replay SDK is integrated and capable of recording screen content during your session. Users should be informed of this capability at onboarding or in privacy settings, with the option to opt out.

2. Transparency About Diagnostic Data Recipients
   The app sends diagnostic telemetry to both Microsoft's own servers (1DS) and Sentry Inc. A clear, accessible in-app summary of which companies receive data and for what purpose would give users meaningful control.

Security Enhancements

1. Hardware-Backed Key Protection
   The authentication key used to sign Xbox Live requests is stored in standard app storage rather than the device's secure hardware enclave. Storing it in the hardware-backed secure storage area (which Microsoft's own AppCenter SDK already does correctly in this same app) would protect the key even on devices that have been modified.

2. Custom URL Scheme Restrictions
   The xbox:// and smartglass:// URL schemes can be triggered by any webpage without restriction. Adding host-based validation before processing incoming links would reduce the risk of unintended actions being triggered by malicious web content.

Technical Context

App Type: Gaming and entertainment companion app (social, console management, digital purchases)

Classes Analyzed: 12,193

Third-Party Services: 13

Context Tags: gaming, location, microphone, social

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Microsoft Corporation

Version: 2604.2.5 (versionCode 326429701)

Analysis Date: 2026-04-22

Package: com.microsoft.xboxone.smartglass

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2604.2.5 analyzed on 2026-04-22
• May not reflect server-side security controls
• Cannot detect all runtime behaviors