wordpress blog stats
Connect with us

Hi, what are you looking for?

Xiaomi warned about critical flaw in its two Android browsers but does nothing

The Hacker News reported on Friday that two browser apps created by Chinese phone maker Xiaomi have a critical vulnerability that has not yet been patched even after being privately reported to the company. The Mi Browser comes built-in with the company’s Mi and Redmi smartphones, while the Mint browser is available on Google Play for non-Xiaomi devices. The Hacker News report said that the vulnerability is an address bar spoofing issue that allows a malicious website to control the URLs displayed. The flaw can be used to easily trick users into thinking they are visiting a trusted website when actually being served with a phishing or malicious content. The issue only affects the international variants of both web browsers and versions distributed with Xiaomi smartphones in China do not contain this vulnerability. Xiaomi, it seems, rewarded the researcher who reported the issue with a bug bounty, but left the vulnerability unpatched.

Second serious issue in two days

This was the second severe issue in two days that researchers identified in pre-installed apps on Xiaomi’s Android devices. On Thursday, Check Point security researchers disclosed a vulnerability in its Guard Provider app. The app is meant to be a security feature but actually exposes users to an attack as it gets its updates through an unsecured HTTP connection, CNet reported. Check Point said it disclosed this vulnerability to Xiaomi, and that the phone maker released a patch to fix the flaw.

Xiaomi launched Mi Pay in India in March

Last month, Xiaomi launched Mi Pay, its UPI payment app, for Xiaomi smartphone users in India. Mi Pay has an NPCI certification and uses ICICI Bank’s payment services for its UPI app. The company claimed that Mi Pay data would be stored only on Indian servers and that it was working with E&Y and Lucideus for data storage and safety.

In June 2018, Xiaomi updated its India and US privacy policy to collect more data than before: financial information like bank account numbers and credit card information, along with “social information” such as “current employer, current job title, education background, professional training background etc”.

Advertisement. Scroll to continue reading.
Written By

MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.



While the market reality of popular crypto-assets like Bitcoin may undergo little change, the same can't be said for stablecoins.


Bringing transactions related to crypto-assets within the tax net could make matters less fuzzy.


Loopholes in FEMA and the decentralised nature of crypto-assets point to a need for effective regulations.


The need of the hour is for lawmakers to understand the systems that are amplifying harmful content.


For drone delivery to become a reality, a permissive regulatory regime is a prerequisite.

You May Also Like


Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...


135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...


Rajesh Kumar* doesn’t have many enemies in life. But, Uber, for which he drives a cab everyday, is starting to look like one, he...


By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Your email address:*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ