“While the findings are no longer applicable, the problem remains, nonetheless. To make matters worse for the company, this isn’t the first time it has been caught in the crosshair of security researchers. This would make it marginally harder for a cybercriminal to access. On Android, while the overall result was the same, the data sent to the servers were encrypted with AES security. On iOS devices, compressed data without a password or encryption containing sensitive information was sent to the UCWeb servers. The obvious step for any user of this browser, whether on Android or iOS, is to stop using it and uninstall it immediately.

This could easily fingerprint users and tie them back to their real personas,” he wrote. “In addition to the visited URL the browser sends the IP of the user and a proprietary ID which seems to have been the same over the duration of the analysis. Things got weirder the more he delved into the issue, leading Cirlig to report his technical findings on a Medium blog. This is regardless of the browsing mode used.Ĭirlig explained what he found in the following tweet:ġ/X There's loads of metadata being sent every time I visited a website on UCWeb. Cirlig discovered that every website iOS or Android users visit is sent to a server at the parent company UCWeb. He was previously responsible for uncovering security issues within certain Xiaomi products. Security researcher Gabi Cirlig discovered the serious flaw in UC Browser.

Import chrome passwords in uc browser