Millions at Risk as Android Mental Health Apps Expose Sensitive Data

"Popular Android mental health apps with more than 14.7 million combined installs contain 1,575 security vulnerabilities, including dozens rated high severity. The findings suggest that users turning to these platforms for privacy and discretion may instead be relying on software riddled with exploitable weaknesses."

"Oversecured analyzed the Android application packages (APKs) of 10 widely downloaded mental health apps using its automated vulnerability scanner, reviewing the latest versions available on Google Play at the time of testing. The scans, conducted between January 22 and 23, 2026, looked for known insecure coding patterns, unsafe data handling, misconfigurations, and other weaknesses across dozens of vulnerability categories."

"According to the researchers, the review focused on identifying weaknesses that could affect authentication flows, local storage protections, inter-app communication, and backend connectivity - areas critical to safeguarding sensitive user information."

Mobile security firm Oversecured analyzed ten widely downloaded Android mental health applications and discovered 1,575 security vulnerabilities across them, with dozens classified as high severity. The apps tested included mood trackers, online therapy platforms, CBT-based tools, and AI chatbots, collectively installed over 14.7 million times. Vulnerabilities identified could enable credential interception, data leakage, and unauthorized access. The research examined insecure coding patterns, unsafe data handling, and misconfigurations affecting authentication flows, local storage protections, inter-app communication, and backend connectivity. These apps store sensitive information including therapy session transcripts, CBT exercises, and mood data, making security flaws particularly concerning for users seeking privacy and discretion.

Read at TechRepublic