Breaches and incidents
Google Pay, Paytm and other UPI apps (India): student’s report of intent, app-lock bypass and audio-focus flaws fixed
B.Tech student Ankit Thakur reported three flaws in UPI apps to Google’s security reporting channel from June 2025.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- B.Tech student Ankit Thakur reported three flaws in UPI apps to Google’s security reporting channel from June 2025: a Chrome intent issue letting malicious websites open UPI apps without user interaction, an authentication bypass of the app lock or biometric layer, and an “audio hijack” in which apps do not lock audio focus during payment so a hidden app can play audio users may take as the payment app’s. Google and Paytm acknowledged the reports and fixes rolled out in February 2026 (Business Today, 13 Apr 2026).
- Root cause: client-side design gaps in Android UPI apps (intent handling, app-lock enforcement, audio focus), per the researcher.
- Attacker: none; researcher disclosure. No evidence of exploitation reported.
- Response: fixed by February 2026 per the report; Google said it verifies reports rigorously before assigning severity.