Bundle Report

com-duckduckgo-mobile-android v5.281.1

Bundle risk41medium

Binary-only · L1Live analyzer output · not mock dataAnalyzed just now

v5.281.1build 52811000medium· 41

3c2072ace5f785ff4c722fd25d683c2e7c190920a44314fe0cbbd07495c274fd

Platform: Android · APK
Bundle size: 119.6 MB
OS range: Android API 26 → Android API 35
Architectures: arm64-v8a, armeabi-v7a, x86, x86_64
Permissions: 22

Store review readiness

Expected to pass review

All known pre-review checks pass.

Submit. All known pre-review checks pass. Reviewer may still raise non-static-analysis concerns (screenshots, metadata, UX) — those are out of scope here.

Blocking0

No pre-review rejection causes

None detected

Needs review0

No reviewer-flag items

None detected

OK5

What was checked and passed

Data Safety form covers SDK-collected data categories
Data Safety form covers third-party sharing
1 bundled SDKs profiled against Google Data Safety
No version-confirmed CVEs against bundled SDKs
Static surface clusters with labeled-clean corpus neighbors· corpus k-NN bad-neighbor weight 0.19 (low)

22 findings

Historical CVE on SDK (build version not detected): RetrofitSDK vulnerability · info
GHSA-8p8g-f9vg-r7xr — Directory Traversal vulnerability in Square Retrofit
component: retrofit
Historical CVE on SDK (build version not detected): RetrofitSDK vulnerability · info
GHSA-j379-9jr9-w5cq — XML External Entity (XXE) vulnerability in Square Retrofit
component: retrofit
Exported Android componentExported component · info
com.duckduckgo.app.launch.LaunchBridgeActivity (activity)
Exported Android componentExported component · info
com.duckduckgo.widget.DuckAiPinShortcutActivity (activity)
Exported Android componentExported component · info
com.duckduckgo.app.dispatchers.IntentDispatcherActivity (activity)
Exported Android componentExported component · info
com.duckduckgo.app.browser.BrowserActivity (activity)
Exported Android componentExported component · info
com.duckduckgo.app.SelectedTextSearchActivity (activity)
Exported Android componentExported component · info
com.duckduckgo.app.settings.SettingsActivity (activity)
Exported Android componentExported component · info
com.duckduckgo.app.systemsearch.SystemSearchActivity (activity)
Exported Android componentExported component · info
com.duckduckgo.newtabpage.impl.settings.NewTabSettingsActivity (activity)
Exported Android componentExported component · info
androidx.compose.ui.tooling.PreviewActivity (activity)
Exported Android componentExported component · info
androidx.work.impl.background.systemjob.SystemJobService (service)
Exported Android componentExported component · info
com.duckduckgo.customtabs.impl.service.DuckDuckGoCustomTabService (service)
Exported Android componentExported component · info
com.duckduckgo.autofill.impl.service.RealAutofillService (service)
Exported Android componentExported component · info
com.duckduckgo.mobile.android.vpn.service.DeviceShieldTileService (service)
Exported Android componentExported component · info
com.duckduckgo.networkprotection.impl.quickaccess.VpnTileService (service)
Exported Android componentExported component · info
androidx.work.impl.diagnostics.DiagnosticsReceiver (receiver)
Exported Android componentExported component · info
androidx.profileinstaller.ProfileInstallReceiver (receiver)
1 tracking SDKs detectedTracking SDK · info
Facebook SDK
Data Safety form must declare: Personal infoData Safety obligation · info
Required by 1 bundled SDK(s): facebook-sdk. Customer's Play Console Data Safety form must declare this category.
component: personal_info
Data Safety form must declare: App activityData Safety obligation · info
Required by 1 bundled SDK(s): facebook-sdk. Customer's Play Console Data Safety form must declare this category.
component: app_activity
Data Safety form must declare: Device or other IDsData Safety obligation · info
Required by 1 bundled SDK(s): facebook-sdk. Customer's Play Console Data Safety form must declare this category.
component: device_or_other_ids

Want PR-level context for this app?

Connect the GitHub repo for this app to upgrade to L3. You'll get per-PR Check Runs, source-aware risk factors, and root-cause attribution against this exact bundle.

Compare tiers