Google Suspends Chinese E-Commerce App Pinduoduo Over Malware
Summary: Google suspended the Pinduoduo app after malware was found in versions of the software, following a February 28, 2023 DarkNavy analysis describing an app that exploited Android vulnerabilities to read other apps' data and resist uninstallation. A Lookout analysis found at least two off-Play Pinduoduo versions exploited CVE-2023-20963, an Android privilege-escalation flaw Google had patched two weeks earlier, letting the app download and run code with elevated privileges.
Bottom line: Pinduoduo reports roughly 900 million monthly active users, and because Google Play is unavailable in China the app remains distributable through Huawei, Oppo, Tencent and VIVO stores - so a Play suspension does not remove it from the devices that carry it.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Mentions
- CVE-2023-20963
- Related
- CVE-2023-20963: Android Framework Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Apr 13, 2023TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026