app threat prototype

nexusoonexus

reproduction steps

Need Hong Kong circuits proxy VPN, from the Play Store download. com.ss.android.ugc.aweme.mobile and com.dragon.read.oversea.gp
Download from APKPure. com.ss.android.ugc.aweme.mobile and com.dragon.read.oversea.gp
open app Search or watch any program content.
Uninstall app
Reinstall app
You will find that your search history and viewing history are still there

By enabling Airplane Mode, clearing storage, and changing the VPN circuits, your search history and viewing history will not change or disappear.

Any app in the Play Store can do this, and it is a privacy disaster.

app has obtained the unique identifier fingerprint of the GrapheneOS system and hardware.

I believe the operational status of GrapheneOS is

unique identifier fingerprints that the app can obtain are random or can be spoof

de0u

nexusoonexus App has obtained the unique identifier fingerprint of the GrapheneOS system and hardware.

Maybe.

I suggest:

https://grapheneos.org/faq#hardware-identifiers
https://grapheneos.org/faq#non-hardware-identifiers (note ANDROID_ID and "advertising ID")

Also see Issue #2314. Please note that the GrapheneOS developers have requested that users not add "I want this too!" or "Is there any update?" posts to issue-tracker threads, and may lock a thread if posts like that are made. It is fine to subscribe to a GitHub issue, and also fine to use reaction emoji on the initial post.

In terms of experimentation, it might be interesting to create a secondary user profile and see whether those apps running in that profile also share history with the owner profile.