Researchers: Russia's Mandatory Super-App Max Systematically Undermines Android Security for Surveillance

A team of researchers from universities in Michigan, Calgary, Georgia, and Delhi has published findings showing that Russia's state-mandated super-app Max systematically undermines Android's security architecture to enable comprehensive surveillance. The app, developed by the Kremlin-linked VK Group, exploits how Android treats super-apps as a single trust entity, enabling screen capture, local storage access, JavaScript injection, network traffic interception, and identity theft across all embedded mini-apps. The researchers warn that Max demonstrates how platform architecture flaws can be weaponized for state repression, with users facing digital excommunication if they fall out of favor with authorities.

Key Takeaways

A team of researchers from universities in Michigan, Calgary, Georgia, and Delhi has published findings showing that Russia's state-mandated super-app Max systematically undermines Android's security architecture to enable comprehensive surveillance.
The app, developed by the Kremlin-linked VK Group, exploits how Android treats super-apps as a single trust entity, enabling screen capture, local storage access, JavaScript injection, network traffic interception, and identity theft across all embedded mini-apps.
The researchers warn that Max demonstrates how platform architecture flaws can be weaponized for state repression, with users facing digital excommunication if they fall out of favor with authorities.

AI synthesis1 source2

An international team of researchers from the University of Michigan, University of Calgary, Georgia Tech, and the University of Delhi has published a detailed security analysis of Max, Russia's state-mandated super-app, revealing how it systematically undermines Android's security architecture to enable comprehensive surveillance.

Max, developed by the VK Group -- whose leadership is closely tied to the Kremlin and is under EU sanctions for its role in suppressing digital free speech -- has been pushed into the Russian market since March 2025. With established messengers like Telegram and WhatsApp blocked or severely restricted by regulator Roskomnadzor, Max has become the mandatory gateway for daily life in Russia: communication in schools, payment processing, and access to the state identity portal Gosuslugi.

The researchers found that Max exploits a fundamental architectural weakness in how Android handles super-apps. Google's operating system treats a super-app and all its embedded mini-apps as a single trust entity. When a user grants permissions or enters sensitive data into a mini-app, those inputs flow through the super-app's runtime environment rather than directly to the OS -- effectively giving the super-app a privileged position to intercept everything.

The team identified five concrete attack vectors:

First, Max can use Android's PixelCopy API to silently capture screen contents from any mini-app, intercepting passwords, banking data, and private messages without triggering any OS warning or requiring special system permissions.

Second, the app has full access to the local storage of embedded mini-apps, allowing it to read and modify cookies, session keys, and authentication tokens in plaintext.

Third, Max can inject arbitrary JavaScript code into running mini-apps. The researchers demonstrated that the app already injects its own code modules to intercept sharing functions and log user behavior.

Fourth, Max controls all network traffic from embedded applications, routing web content, error messages, and console output through state-controlled proxy servers.

Fifth, the app can perform complete identity theft by impersonating users to mini-apps or submitting falsified inputs without the user's knowledge.

The researchers note that Max includes sophisticated anti-analysis mechanisms: it continuously checks for VPN interfaces, SIM card metadata, location data, and system timezones, and refuses connections from non-Russian IP addresses. The Russian version uses state-mandated GOST TLS encryption and a proprietary communication protocol instead of international security standards.

The analysis carries broader implications beyond Russia. The researchers argue that super-apps should be treated like browsers at the OS level, with strict isolation between mini-apps enforced by the operating system itself. They warn that the trend toward weakening end-to-end encryption -- visible in the UK's Online Safety Act, Canada, and the EU's potential chat surveillance -- creates similar vulnerabilities in democratic societies.

Insiders reportedly continue to use Telegram or Signal for daily communication, using Max only on secondary devices.