On September 30, 2026, Android developer verification began in Brazil, Indonesia, Singapore and Thailand. Apps installed from seven participating stores on certified devices must be registered to a developer whose identity Google has verified. Google plans a global rollout in 2027.
On September 24, 2026, UpGuard reported 16,326 Supabase databases exposing readable tables, among about 300,000 websites with Supabase indicators in their JavaScript. Over half had indicators of personal data. The sample is websites; Supabase mobile apps contain the same kind of URL and key.
Apple's iOS 27 security notes, released September 14, 2026, list 126 CVE IDs. Fourteen entries describe an app obtaining persistent identifiers, fingerprinting signals, the list of installed apps, location from system logs, cross-app tracking or Privacy preferences. iOS 26.7 fixes seven of them.
On August 4, 2026, EFF named four Android ad SDKs that share location by default once an app has location permission. EFF's published capture shows precise coordinates sent to api.bidmachine.io from QR Scanner and GPS Speedometer; on Oct. 2, neither app's Play Data safety section listed location.
On April 9, 2026, Microsoft detailed an intent redirection flaw in the EngageLab Android SDK: the exported MTCommonActivity let another app on the same phone obtain read and write access to the host app's private files. Wallet apps with the SDK had over 30 million installs. Version 5.2.1 fixes it.