Developers around the world are harnessing mobile app extensions to create powerful new user experiences. However, with increased complexity comes an even greater need to prioritize security and data privacy.

But from a security and privacy point of view, application extensions can be a nightmare. If developers and mobile device management teams don’t carefully validate app extensions and ensure that they are secure, extensions can become an open door to significant risks, such as application collusion.

Keep reading for a look at the security challenges that emerge when users install application extensions, as well as tips on how to manage them.

A mobile application extension is a software program tailored to extend the functionality of a pre-existing mobile application through the integration of additional features and capabilities. This type of extension provides users with access to a wide range of functionalities, enhancing their overall experience with the mobile application.

You might encounter other definitions of application extensions; for example, Android uses the term “Extension” to refer to a feature that helps manage certification hierarchies, and “application extension” more generally can refer to the suffix on the end of the filenames of applications. These are not what we mean when we talk about application extensions in this post, however.

Developers typically build application extensions to implement additional functionality that is not part of the “core” application. Unlike standalone mobile applications, mobile application extensions are part of a larger ecosystem, working in tandem with the original application to provide users with a more comprehensive and sophisticated digital experience. Mobile application extensions can range from simple add-ons to more complex functionalities, such as advanced analytics, augmented reality capabilities, and chatbot integrations. For example, a mobile banking app could be extended with an add-on that provides a way of viewing data from external bank accounts within the mobile application. Or, an extension could provide additional features, such as tools to help track spending, that are not available in the application itself.

App extensions offer many potential benefits to developers and users. For developers, extensions can help to make applications more flexible because they offer a way of separating optional features or integrations from an application. When it comes to user experience, mobile application extensions can enhance and streamline functionality, making a user’s experience more intuitive and seamless. They are a way to add new features without cluttering up the existing UI, which can lead to a more intuitive user experience and more engaged users.

Poorly implemented or managed application extensions can create many more problems than they solve in the form of security and data privacy risks. These include not just the typical risks that exist in any software (like vulnerabilities inside source code or dependencies), but challenges that are unique to application extensions and integrations.

Here’s a look at two of the most common types of security risks unique to extensions.

Application collusion is a type of security risk that occurs when two applications (or an application and an extension) combine their functionality in a way that allows them to carry out actions that would not be possible for each app to perform individually; where one that acts as the attacker and another that acts as a seemingly harmless facilitator. The primary objective of mobile application collusion is to steal valuable information such as personal identification details, financial information, and sensitive corporate data.

As a basic example of application collusion, imagine that you install an Android application for managing photos. You’d give the application permission to manage images stored on your device because that’s central to its job. But you don’t want the application to be able to share photos with your contacts, so you block permission for it to access contact lists.

Later, you decide to extend the photo management application with an add-on. The extension has its own set of permissions, which include the ability to access contact lists. Because you already configured permissions for the primary application when you installed it, you don’t think about the risks of granting additional permissions to the extension. As a result, when the application and the extension run together, they are able to combine their permissions so that the application can access your photos and contact lists.

This is a simple example, and it’s a type of risk that could emerge not just from malicious activity, but also from simple oversight on a user’s part during permissions configuration. However, in more advanced application collusion attacks, malicious actors can deliberately design extensions that bypass OS-level security controls designed to keep each application running in a sandboxed environment. The result is attacks or data exposure events that users don’t even know are happening.

Extensions that allow applications to share data could lead to risks like insecure data storage because sensitive data produced by one application may not be properly secured by another application that stores or manages it.

For instance, consider an app extension that integrates a banking app with an email app so that users can send emails to their banking provider directly from within the banking app. Because the extension sends data from the banking app into the email app, there is a risk that the email app won’t properly secure sensitive information. The banking app might initiate an email containing a user’s banking information, for instance – information that is encrypted inside the banking app, but which the email app might store in plain text.

Protecting against the security and privacy risks posed by application extensions starts with following the core best practices that help secure any type of mobile application: don’t install applications from untrusted sources, scan applications for vulnerabilities, enforce zero trust permissions for new devices on your network, and so on.

It is vital to be cautious while installing mobile applications from untrusted sources. There are several risks associated with this practice, such as exposing your device to the risk of malware, viruses, spyware, and other malicious software. When you download applications from untrusted sources, you risk your personal and financial information being stolen, leading to identity theft, online scams, and other damaging consequences. Moreover, the application may be designed to compromise your privacy by collecting sensitive information without your knowledge. Installing applications from reputable app stores reduces the risk of such potential harm and ensures that you have access to tested and verified applications. It is essential to remain vigilant and only download applications from trusted sources to protect yourself, your device and your valuable data.

It is essential to conduct regular scans to ensure that these extensions are free of vulnerabilities. Through scanning with platforms like Q-MAST, businesses can identify and remediate vulnerabilities before they are exploited by malicious actors. Failure to scan for vulnerabilities in mobile app extensions can lead to data breaches, financial damage, and reputational harm. Additionally, scans can help identify vulnerabilities in third-party libraries and plugins that may be integrated into mobile app extensions. As such, mobile application developers need to prioritize scanning mobile app extensions for vulnerabilities to ensure that their products are secure and dependable. By adopting this proactive approach, businesses can protect their users and build trust in their brand.

Zero Trust security is a model that assumes no trust within a system, device, or network, and requires a user to authenticate their identity before accessing any sensitive information or resources. For mobile app extensions, this means that developers must ensure that all permissions requested by the extension are necessary and relevant to the user’s needs. Additionally, developers must ensure that users understand the implications of granting permissions to the app extension and provide them with clear and concise information regarding the extension’s data collection and usage policies. By implementing these strong security measures, developers can not only protect their users’ data and privacy but also ensure that their apps comply with industry standards and best practices.

We’re not saying you should avoid application extensions. On the contrary, extensions have clear value for developers and users alike. But to take advantage of that value in a responsible way, it’s critical to ensure that you properly manage the security risks that can arise from extensions – a task that requires steps above and beyond standard mobile security scanning.