Alipay (1B+ users) DeepLink vulnerability allows silent GPS extraction via URL - 6 regulators now investigating, vendor says normal functionality

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Alipay Vulnerabilities Enable Silent GPS Data Exfiltration via DeepLink Attack A researcher has identified 17 vulnerabilities in Alipay, impacting over 1 billion users. The attack method involves a crafted URL that silently exfiltrates GPS coordinates with high accuracy through a DeepLink, WebView, and JSBridge chain. The vulnerabilities include 6 CVEs submitted to MITRE, with CVSS scores ranging from 7.4 to 9.3. Notably, the attack can capture GPS data without user consent and has been demonstrated across three devices in three different countries. Despite the severity, Alibaba, the parent company, has not assigned CVEs for some vulnerabilities. The vendor claims the functionality is normal, but a takedown complaint was filed four hours after the discovery. The researcher submitted a proof of concept to Reddit. 2 sources 71