Coin Master (com.moonactive.coinmaster): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Coin Master.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Coin Master
Private
2026-06-24
93d ago
Silent
High
Coin Master, installed over 100 million times, reads the address book of its own users to learn the names of people who never installed the app and never consented to anything, and separately pulls a user's Facebook friends list, combining both into a complete social map of people who have no relationship with the company at all. The app also ships a child-safety switch that is built into the code but never turned on, meaning behavioral advertising profiling runs on every player, including children, in a game built around real slot-machine spins. Across eight messages over more than two months, nobody at Moon Active ever replied.
com.moonactive.coinmaster, Moon Active Ltd, 100M+ installs. All five findings re-scored under CVSS v4.0. READ_CONTACTS backed by three dedicated first-party libraries reading non-user contact data with no Art. 6(1) legal basis, and a Facebook Friend Finder OAuth scope combining with those same contacts into a complete social graph, both reach HIGH on their own computed CVSS scores. A declared-but-never-activated AppLovin age-restriction flag, setIsAgeRestrictedUser(true) called zero times across 9,801 smali files in an app built on explicit slot-machine and casino mechanics, computes to MEDIUM alone but is held at HIGH under blast-radius escalation given the unconditional 100M+ install base and the combination of undisclosed behavioral ad profiling of minors with gambling-adjacent mechanics. Pre-consent ad SDK initialization, including three BOOT_COMPLETED receivers that fire the same chain on device reboot, and hardcoded Firebase API keys both correct to MEDIUM. Eight messages sent across 65 days to privacy@ and dpo@moonactive.com, a separate BCC copy to the UK ICO bounced due to an unrelated mail-flow rule. Not one reply of any kind was ever received. Case closed and published 2026-09-25, six days after the stated 2026-09-19 embargo.
click to expand
GDPR Art. 32GDPR Art. 8
Yes
Closed
Disclosure
93d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.