The Electronic Frontier Foundation has discovered that Android app developers may be unwittingly allowing third-party code to harvest users' location data. Developers granting location permissions to their apps could be exposing sensitive information to advertisers without their knowledge.
The EFF's findings reveal a significant privacy gap in how Android apps handle permissions. When developers integrate third-party code libraries—common practice for adding features like analytics or advertising—those libraries can access location data granted to the main app.
Developers may not realize that permissions they request from users extend to all embedded code within their applications. This means a location permission intended for core app functionality could inadvertently enable data collection by advertising networks.
The issue highlights a broader problem with permission systems: users grant permissions to apps, but often lack visibility into how third-party code uses that data. While Android's permission model is designed to give users control, the complexity of app dependencies creates blind spots.
The EFF's warning serves as a call for developers to audit their third-party dependencies and understand what data access those libraries receive. Google has not yet responded to the findings.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.
A critical SQL injection vulnerability in Metabase is being actively exploited in the wild to steal customer data. The zero-day attack has already compromised instances at Framework and Tally.
Healthcare software company Unlimited Technology Systems disclosed a data breach affecting 3.8 million individuals. The breach occurred in October 2025.