Android Mental Health Apps With 14.7M Downloads Found to Have Security Flaws

Summary

Oversecured found 1,575 security issues in 10 Android mental-health apps with more than 14.7 million downloads, including flaws that could expose therapy data. Researchers could not confirm whether developers have fixed them.

Key points

Oversecured scanned APKs from 10 mental-health apps and reported 1,575 issues: 54 high-, 538 medium- and 983 low-severity.
The apps had more than 14.7 million collective downloads; the article does not name them because disclosure is ongoing.
In one app with more than one million downloads, an externally controlled string passed to Intent.parseUri() could open internal activities without validating the target component, potentially exposing authentication or session data.
Other reported weaknesses include locally stored data readable by other apps, plaintext API and configuration data, and java.util.Random used for session tokens or encryption keys.
Researchers said most of the apps lacked root detection; exposed local information could include therapy notes, mood logs and medication schedules.
The scans covered app versions available on January 22–23, 2026. Oversecured could not confirm whether the reported issues had been fixed.

Article Details

Event Type: Security research findings on vulnerabilities in ten Android mental health apps available on Google Play.
Impact: Oversecured reported 1,575 vulnerabilities across the apps: 54 high-, 538 medium-, and 983 low-severity findings. The apps have more than 14.7 million collective downloads and may expose therapy records, medical information, credentials, session data, or location-related information. Reported issues include unsafe handling of externally supplied URIs, insecure local storage, plaintext configuration data, and weak token generation. Researchers could not confirm whether the vulnerabilities had been fixed.