一句话：对 11 个主流推送 SDK 与 5 万余款应用进行系统性安全评估，揭示密钥泄露、通知劫持与明文载荷三类风险。
Android 生态碎片化使得开发者往往同时集成多家厂商与第三方的推送 SDK，而既有研究几乎只关注 Google 的 Firebase Cloud Messaging，其他推送服务的安全风险缺乏系统考察。本文对 Android 推送通知生态开展系统性安全评估，覆盖 11 个主流推送 SDK 与多个应用市场中的 52,748 款应用，并沿推送工作流归纳出三类风险：服务器密钥泄露、通知劫持与通知载荷明文暴露。研究发现 517 款应用泄露服务器密钥，累计安装量至少 787.9 亿次；攻击者可借此伪造任意标题与正文的通知、在点击后将用户重定向至任意 URL，且此类伪造通知能在 11 个推送服务中的 9 个上向全体用户广播。此外，4 个广泛使用的推送 SDK 存在通知劫持漏洞，可被用于重定向受害者通知；在评估的 110 款通信类应用中，无一在载荷进入推送服务基础设施前施加保护，敏感内容以明文形式暴露。作者已负责任地向推送服务提供商与应用开发者披露问题并获确认，指出需要开发者与推送服务方共同加强防护。
Push notification services are widely used in mobile apps to deliver time-sensitive content. In the fragmented Android ecosystem, however, no single push service works reliably across all devices and markets, leading developers to integrate multiple push SDKs from device manufacturers and third-party providers. Despite their widespread use, prior studies have focused mainly on Google’s Firebase Cloud Messaging, leaving the security risks of other push services largely unexplored. In this paper, we present a systematic security assessment of the Android push notification ecosystem, covering 11 mainstream push SDKs and 52,748 apps across multiple Android app markets. Our analysis reveals three classes of security risks across the push notification workflow: server secret leakage, notification hijacking, and plaintext exposure of notification payloads. Specifically, we identify 517 apps that leak server secrets, accounting for at least 78.79 billion cumulative installs. These leaks enable attackers to forge notifications with attacker-controlled titles and bodies, redirect users to arbitrary URLs after a click, and, in 9 of the 11 evaluated push services, broadcast such notifications to all users. We further show that four widely used push SDKs are vulnerable to notification hijacking, enabling attackers to reroute victim notifications. In addition, among the 110 communication-oriented apps we evaluated, none protects notification payloads before they enter push service infrastructure, leaving sensitive content exposed in plaintext. These findings show that securing real-world push services requires stronger protections from both app developers and push service providers, highlighting the need for more secure push deployment in industry practice. We responsibly disclosed the issues to push service providers and app developers, and received acknowledgments from affected parties.
@inproceedings{paperbot12344,
title = {An Empirical Study of Security Risks in the Android Push Notification Ecosystem},
author = {Shilong Hu and Zikan Dong and Chao Wang and Tianming Liu and Haoyu Wang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834475}
}