Phishing user to download malicious app could lead to leakage of User Access Token, Email, Name and Profile photo via exported RemoteService

Summary

Thanks @shivasurya for helping us keep @zomato secure :)

One of the service components in the Zomato Android app was open to bind a service connection ( AIDL ) So, if an attacker would have phished a user to download a malicious app, it could have lead to leakage of access token of the user that leads to account takeover.

Zomato acted promptly to fix the issue and rolled out the update.