Abandoned IoT Apps Keep Sending Sensitive Data to Broken Servers
Help Net Security, Friday, September 18th, 2026
Nearly three in four of 61,500 abandoned Android IoT companion apps carry dependencies with documented vulnerabilities.
University of Massachusetts Amherst researchers analyzed 61,500 abandoned Android IoT companion apps, the software used to control smart plugs, cameras and thermostats, defining abandoned as two years without an update or removal from Google Play by March 2025.
Nearly three in four contained software dependencies tied to documented vulnerabilities, most falling into higher severity tiers. Abandonment did not mean small audiences: most apps had thousands of installs and a dozen had passed 100 million downloads before development went quiet.
The apps also hold thousands of hard-coded web addresses, and about a quarter of the unique domains extracted no longer resolve at all.