A major Android security flaw puts almost half (49.5 percent) of the users at risk. The bug allows attackers to modify or replace a seemingly benign app with malware without users’ knowledge, according to a blog post written by researchers at Palo Alto Networks.

When the exploit was first discovered in January 2014, more than 89 percent of Android devices were vulnerable to the attack. Android 4.4 has since been upgraded to fix the android security flaw. But still around half of the users are left vulnerable.

Caution for App Developers

App developers need to maintain a lot of caution. There are several ways in which this android security flaw can be misused. The simplest thing possible is that a victim can be fooled into installing a false application that appears to be legitimate, since the app does not require any unusual permissions and can come from any app store. Whenever the user downloads a second app from a third-party app store, this app can now detect it and overwrite it with malware while the user is viewing the permissions screen.

For developers: Devknox

Here’s another example: The first app can actually promote a second app as an advertisement within itself. When the user tries to download the second app, the first app can likewise modify the second app while the user is viewing the package installer activity.

App developers should also be wary of the android security flaw. Apps and mobile ad libraries that do not rely on the Google Play store are likely to save promoted apps in unprotected storage that could allow attackers to replace them with malware.