Notifications
Clear all
Topic starter
02/08/2026 12:16 pm
TL;DR: A Safari extension can gain broad page-level visibility, inject code across sites and collect browsing signals, while the app also weakens default transport protections and attempts to fingerprint installed apps, according to NowSecure. The pattern reinforces that app approval now needs stronger privacy governance, runtime scrutiny and identity-aware access controls, not just functional review.
NHIMG editorial — based on content published by NowSecure: analysis of the Phia iOS shopping app and its Safari extension data overreach
Questions worth separating out
Q: How should security teams assess mobile apps that request broad browser access?
A: Treat broad browser access as a privileged permission rather than a routine mobile feature.
Q: What breaks when a mobile app extension runs in the page context?
A: Page-context execution removes a major isolation boundary.
Q: Why do mobile app privacy issues matter to IAM and GRC teams?
A: Because the permissions that enable overcollection are themselves access decisions.
Practitioner guidance
- Review extension permissions as privileged access Require explicit review for any mobile app extension that requests broad website access, page-context execution or native bridge capability.
- Test for runtime data collection beyond declared function Use dynamic mobile app analysis to observe what the app and its extension actually collect across real browsing sessions, including cookies, URL parameters and page content.
- Validate transport and fingerprinting controls before release Check whether App Transport Security is disabled, whether the app probes installed URL schemes and whether the network stack allows unsafe behaviour.
What's in the full report
NowSecure's full analysis covers the operational detail this post intentionally leaves for the source:
- Static and dynamic analysis artifacts for the iOS Safari Web extension, including manifest behaviour and page-context execution details.
- The whitelist and exclusions model used by the app, with practical examples of how broad collection still occurs.
- Observed app behaviour around URL scheme probing and transport-hardening choices.
- Technical comparison points between the iOS and Chrome extension behaviour that inform mobile AppSec review.
👉 Read NowSecure's analysis of the Phia iOS app and Safari extension data overreach →
Mobile app data overreach: what AppSec and IAM teams need to know?
Explore further
02/08/2026 1:18 pm
Data overreach is now an access-control problem, not just a privacy problem. When a mobile app can read page context, network metadata and device signals, the real issue is whether the requested access matches the business purpose. That is an IAM-style governance question applied to mobile software behaviour, and it should be reviewed with the same discipline used for privileged applications. Practitioners should treat permission scope as a control boundary, not a consent checkbox.
A question worth separating out:
Q: How can organisations reduce risk from consumer apps used on managed devices?
A: Set a higher review bar for apps that touch managed devices, shared credentials or employee browsing. Require dynamic testing, transport-hardening checks and clear owner accountability before approval. If the app’s behaviour cannot be explained in operational terms, treat it as a risk to both privacy and enterprise control.
👉 Read our full editorial: Mobile app data overreach is widening the privacy and security gap
