Android mental health apps with 14.7M installs filled with security flaws

Bleeping Computer

by Ionut Ilascu

February 23, 2026

AI-Generated Deep Dive Summary

A recent study revealed alarming security vulnerabilities in ten popular Android mental health apps with millions of downloads on Google Play. These apps, designed to assist users with conditions like depression and anxiety, have been found to contain over 1,500 security flaws, including high-severity issues that could expose sensitive medical data. Researchers identified weaknesses such as insufficient validation of user-supplied URIs, which could allow attackers to access internal app functions and steal authentication tokens. Additionally, some apps store therapy records locally with inadequate protection, making them accessible to other apps on the device or exploited by malicious actors. The vulnerabilities discovered include insecure storage of sensitive data, plaintext configuration data exposed in backend APIs, and the use of weak random number generators for encryption keys. These issues highlight a concerning lack of robust security measures in apps that handle highly personal information. For instance, one app with over a million downloads used an insecure method to parse URIs, potentially allowing unauthorized access to therapy records. Furthermore, researchers found instances where local storage permissions were too broad, and some apps lacked root detection features, leaving sensitive data vulnerable on rooted devices. The implications of these findings are significant, especially given the sensitivity of mental health data. Cybercriminals can exploit these vulnerabilities to sell therapy records for substantial profits on the dark web, as noted by security experts. The study underscores the urgent need for developers to prioritize secure coding practices and implement stronger encryption and access controls. Users should remain cautious when choosing mental health apps, ensuring they are from trusted sources and have strong privacy protections in place. This report highlights a critical gap in mobile app security, particularly in the healthcare sector where data breaches can have severe consequences. Developers must address these vulnerabilities to safeguard user trust and comply with regulations like HIPAA, which protect sensitive health information. As mental health apps continue to gain popularity, ensuring their security is paramount to prevent potential harm from data breaches.

Verticals

securitytech

Originally published on Bleeping Computer on 2/23/2026