Don't Trust the Super-App: A Case Study of Russia's Max

• URL: http://arxiv.org/abs/2609.11814v1
• Date: Thu, 10 Sep 2026 17:08:00 GMT
• Title: Don't Trust the Super-App: A Case Study of Russia's Max
• Abstract summary: Super-apps host third-party mini-apps inside a single app.<n>We show how malicious super-apps have undeniable capabilities to silently undermine the security and privacy of mini-apps.
• Score: 6.434185166424619
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Super-apps, an emerging mobile architecture, host third-party mini-apps inside a single app, allowing users to access diverse services. A decade of security research on the super-app ecosystem has all assumed super-apps to be a trusted intermediary. We argue this implicit trust is difficult to justify: China's WeChat is already shown to passively track its user's activity across mini-apps at extraordinary scale; Russia's MAX's parent company is reported to be deeply entangled with the state prosecution of online speech; and Iran's Bale was reported to be functioning in the world's longest internet shutdown due to its state-backed support. In this paper, we show how malicious super-apps have undeniable capabilities to silently undermine the security and privacy of mini-apps and users without leaving any trace. Using MAX as an example, we show how it can capture mini-app UI, read and write mini-app local storage, inject arbitrary JavaScript into a mini-app's runtime, mediate mini-app network traffic, and control authentication context in ways that can enable silent user impersonation. Sadly, these capabilities manifest themselves in any super-app because of the architectural privileges granted to them by design. We argue that mobile OS and app store interventions are urgently needed to close this architectural blind spot before it is further exploited.

Related papers

• TENET: Telegram Mini App (in)security [2.1793134762413433]
  Many Mini Apps store authentication materials, exposing users to unauthorized access, impersonation, and financial exploitation.<n>We present TENET, a purpose-built auditing tool whose design decisions are grounded in the structural properties of the secrets targeted.<n>We propose mitigation measures and best practices for both Telegram platform developers and third-party Mini App creators.
  arXiv  Detail & Related papers  (2026-08-18T08:59:03Z)
• TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps [3.345437353879255]
  Telegram Mini Apps are Web applications embedded within the Telegram client.<n>Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored.<n>We present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps.
  arXiv  Detail & Related papers  (2026-08-13T15:51:18Z)
• PhoneBuddy: Training Open Models for Agentic Phone Use [104.23243994660936]
  PhoneBuddy is a training recipe and open-model line for agentic phone use.<n>It combines a real-app environment with a mock-app environment, PhoneWorld, which reconstructs run mock apps from real GUI usage structure.<n>PhoneBuddy first builds a shared supervised fine-tuning stage from trajectories collected in both environments, then compares real-app RL against mixed RL.
  arXiv  Detail & Related papers  (2026-06-22T08:57:54Z)
• ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? [92.21756459993695]
  Exploitation is a challenging task because it requires low-level program reasoning.<n>Despite its importance and diagnostic value, exploitation remains under-evaluated.<n>We introduce ExploitGym, a large-scale, diverse, realistic benchmark on the exploitation capabilities of AI agents.
  arXiv  Detail & Related papers  (2026-05-11T18:00:14Z)
• Do Phone-Use Agents Respect Your Privacy? [97.81424230136075]
  We introduce MyPhoneBench, a verifiable evaluation framework for privacy behavior in mobile agents.<n>We operationalize privacy-respecting phone use as permissioned access, minimal disclosure, and user-controlled memory through a minimal privacy contract.<n>Across five frontier models on 10 mobile apps and 300 tasks, we find that task success, privacy-compliant task completion, and later-session use of saved preferences are distinct capabilities.
  arXiv  Detail & Related papers  (2026-04-01T14:50:50Z)
• OpenApps: Simulating Environment Variations to Measure UI-Agent Reliability [49.99934595922838]
  Reliability is key to realizing the promise of autonomous UI-Agents.<n>We develop OpenApps, a light-weight open-source ecosystem with six apps.<n>We run more than 10,000 independent evaluations to study reliability across seven leading multimodal agents.
  arXiv  Detail & Related papers  (2025-11-25T19:00:22Z)
• I Can Tell Your Secrets: Inferring Privacy Attributes from Mini-app Interaction History in Super-apps [14.642699257599991]
  This paper reveals a new privacy leakage source in super-apps: mini-app interaction history (Mini-H) and operation history (Op-H)<n>Mini-H refers to the history of mini-apps accessed by users, such as their frequency and categories. Op-H captures user interactions within mini-apps, including button clicks, bar drags, and image views.<n>We design a mini-app interaction history-oriented inference attack (THEFT), to exploit this new vulnerability.
  arXiv  Detail & Related papers  (2025-03-13T10:29:40Z)
• Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code [19.7220607313348]
  Mini-applications, commonly referred to as mini-apps, are compact software programs embedded within larger applications or platforms. This paper investigates the potential of employing Large Language Models (LLMs) to detect privacy breaches within WeChat Mini Programs.
  arXiv  Detail & Related papers  (2024-02-12T01:55:40Z)
• MiniScope: Automated UI Exploration and Privacy Inconsistency Detection of MiniApps via Two-phase Iterative Hybrid Analysis [14.835715789786137]
  MiniApps, operating within larger SuperApps, have revolutionized user experiences by offering a wide range of services without the need for individual app downloads.<n>Despite existing privacy regulations and platform guidelines, there is a lack of effective mechanisms to safeguard user privacy fully.<n>We introduce MiniScope, a novel two-phase hybrid analysis approach, specifically designed for the MiniApp environment.
  arXiv  Detail & Related papers  (2024-01-06T13:54:36Z)
• Demystifying Removed Apps in iOS App Store [0.0]
  This paper takes the initiative to conduct a large-scale and longitudinal study of removed apps in the iOS app store. Our analysis reveals that although most of the removed apps are low-quality apps, a number of them are quite popular.
  arXiv  Detail & Related papers  (2021-01-13T14:34:26Z)
• Emerging App Issue Identification via Online Joint Sentiment-Topic Tracing [66.57888248681303]
  We propose a novel emerging issue detection approach named MERIT. Based on the AOBST model, we infer the topics negatively reflected in user reviews for one app version. Experiments on popular apps from Google Play and Apple's App Store demonstrate the effectiveness of MERIT.
  arXiv  Detail & Related papers  (2020-08-23T06:34:05Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.