Google Messages — the preview that reveals your IP
Google Messages builds link previews on the device, handing the recipient’s IP address and device details to the link’s server. Built into a very large share of Android phones.
Case 01IP leak via link previewCVSS 4.3Published
imo Messenger — the link that reads you
A zero-click IP leak: receiving a URL makes your own device reveal your IP to the sender. 500M+ installs, reported via CISA/CERT-CC and BSI.
Case 02Zero-click IP leakCVSS 4.3 / 6.2Published
Olvid Messenger — when a leak isn’t a bug
Two ways a privacy-focused messenger can expose an IP address. The vendor considers both deliberate trade-offs — and after the coordinated review, I agreed. A fair analysis.
Case 03IP exposureCoordinated via ANSSI/CERT-FRPublished
SKRED Messenger — one key for every device
A built-in fallback key protected local data with a key identical on every device. The open-source vendor responded exemplarily and fixed it promptly.
Case 04Hard-coded fallback keyLocal / fixedPublished
Disclosure, done properly.
Every case here was reported to the vendor first and coordinated through national CERTs before publication. The write-ups favour defensible severity scores over dramatic ones, and document the full timeline — including the parts where no one replied.