This information is intended for developers of apps that utilize any version of the Vungle ad library that precedes 3.3.0. These versions contain a security vulnerability and are in violation of the Dangerous products provision of the Content Policy, and section 4.4 of the Developer Distribution Agreement.
Please migrate your app(s) to Vungle v.3.3.0 or higher as soon as possible and increment the version number of the upgraded APK. Google Play will block publishing of any new apps and updates that use pre-3.3.0 versions of Vungle. If you are using a 3rd party library that includes Vungle, please notify the 3rd party and work with them to address the issue.
What’s happening
Please refer to the notice on your Play Console. After the deadlines shown in your Play Console, any apps that contain unfixed security vulnerabilities may be removed from Google Play.
Action required
- Sign in to your Play Console, and navigate to the Alerts section to see which apps are affected and the deadlines to resolve these issues.
- Update your affected apps and fix the vulnerability.
- Submit the updated versions of your affected apps.
Upon resubmission, your app will be reviewed again. This process can take several hours. If the app passes review and is published successfully, then no further action is required. If the app fails review, then the new app version will not be published and you will receive an email notification.
Additional details
The vulnerability can enable attackers to launch a Man-in-the-middle (MITM) attack against user devices by proxying network traffic and injecting a payload extracted by the Vungle app. The vulnerability was addressed in Vungle v3.3.0. To check your Vungle version, you can do a grep search for “VungleDroid/”.
The latest version of Vungle can be downloaded from the Vungle website. For help upgrading, see this Vungle support page. For more information about the vulnerability, please see https://gist.github.com/Fuzion24/6535f8b9dc2a51745173. If you have other technical questions, please post to https://www.stackoverflow.com/questions and use the tags “android-security” and “vungle.”
To confirm you’ve upgraded correctly, submit the updated version to the Developer Console and check back after five hours. If the app hasn’t been upgraded correctly, we will display an alert.
Note: while these specific issues may not affect every app that uses Vungle, it’s best to stay up to date on all security patches. Please take this time to update apps that have out-of-date dependent libraries or other vulnerabilities.
Before publishing apps, please ensure they are compliant with the Developer Distribution Agreement and Content Policy.
We’re here to help
If you have technical questions about the vulnerability, you can post to Stack Overflow and use the tag “android-security.” For clarification on steps you need to take to resolve this issue, you can contact our developer support team.