Original title: Don't Trust the Super-App: A Case Study of Russia's Max
Richa Priyanka, Aaron Ortwein, Joel Reardon, Michael Specter +2 · September 2026
Super-apps are large programs that run smaller mini-apps inside them, letting you access many services in one place. For ten years, security researchers assumed the host super-appA single mobile app that hosts many smaller apps inside it, like WeChat. was trustworthy. However, super-apps in countries like China, Russia, and Iran already show worrying signs of state ties, surveillance, and special backing. Researchers studied Russia's MAX to see if a hostile super-app could abuse its power. Because a super-app hosts everything, it naturally holds ultimate control over what happens inside it. The team found MAX can secretly capture mini-appA smaller app that runs inside a super-app, providing a specific service. screens, read and change their saved data, alter network traffic, inject code, and manipulate login systems to quietly impersonate users without leaving a trace. Because these dangers come from the core design of super-apps, the researchers urge mobile operating systems and app stores to step in and fix this loophole.
You rent a room in a shared house. The landlord has a master key and can enter anytime, but you trust them not to. Now imagine the landlord can secretly watch you, rearrange your furniture, and even pretend to be you to your friends. In this paper, the super-app is the landlord and the mini-apps are the tenants, and the research shows the super-app can do all these things without leaving a trace.
Super-apps like WeChat, MAX, and Bale are used by billions for banking, messaging, and more. This research shows that the super-app itself can silently steal data, impersonate users, and manipulate mini-apps without detection. That means neither users nor mini-app developers can trust the super-app, and the entire ecosystem needs a security rethink.
The abstract doesn't say explicitly, but the paper is a case study of one super-app (MAX), so the specific attacks may not cover all super-apps. It does not propose a concrete technical fix, only calls for OS and app store interventions. The paper does not measure how often these capabilities are exploited in practice.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Don't Trust the Super-App: A Case Study of Russia's Max — Richa Priyanka, Aaron Ortwein, Joel Reardon et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.