Disney Solitaire (com.superplaystudios.disneysolitairedreams): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Disney Solitaire.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Disney Solitaire
Private
2026-06-25
92d ago
Waiting
Medium
This Disney-licensed card game runs four separate advertising systems that all start working before the app's own built-in consent tool can even appear on screen, meaning that tool cannot actually do its job. On top of that, an access key is hardcoded directly into the app, and player activity is fed into advertising profiles that can follow players into other, unrelated apps.
com.superplaystudios.disneysolitairedreams. SuperPlay Studios / Disney license. All seven findings re-scored under CVSS v4.0, correcting to MEDIUM. Four ad/platform SDK ContentProviders (Vungle, AppLovin, AdMob, Firebase) fire in sequence before AppLovin's own bundled consent tool can ever load, the most aggressive pre-consent ad stack found in this audit series. Firebase+AppLovin keys hardcoded, Facebook codeless event logging, Custom Audience cross-app targeting, and a five-network ad mediation stack all present. Nine messages sent across 92 days, two addresses bounced outright, zero reply ever received.
click to expand
GDPR Art. 7GDPR Art. 32(1)(b)GDPR Art. 6(1)
Yes
Closed
Disclosure
92d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.