TenCent did not respond to these queries. Although some problems were solved, others still remain.Ĭitizen Lab researcher, Ron Deibert, sent inquiries to TenCent about their data collection activity and whether these actions were done in support of nation state directives. These vulnerabilities were disclosed to TenCent Februand several updates to address these vulnerabilities were released March 2016. This weakness could allow threats to trick users into downloading malware on to their mobile devices. The collection of this information by TenCent is concerning especially with the lack of cybersecurity controls in place.Īnother problem is the fact that the update mechanism in the QQ browser is not secured. The collection of information using weak encryption or lack thereof can lead to spying by the user’s ISP, wireless network operator, mobile carrier, malicious actors, or a government agency. This transmission of data is all done without encryption or with weak encryption.

The Windows version of QQ sends out the URLs of all visited webpages, the user’s hard drive serial number, MAC address, Windows hostname, and Windows user security identifier. The Android version of QQ shares “personally identifiable data, including a user’s search terms, the URLs of visited websites, nearby WiFi access points, and the user’s IMSI and IMEI identifiers, without encryption or with easily decrypted encryption.” What most people don’t know is that the mobile browser shares a large amount of personal information about the user, and the app also leaves the user open to malware that can be installed on their phones. The QQ mobile browser is available on both Android and Windows Mobile phones. Researchers at the Citizen Lab in the of Toronto’s Munk School of Global Affairs have found several problems related to the use of Chinese Company TenCent’s QQ Mobile Browser.

Qq browser windows