Etihad Airways (com.mttnow.android.etihad): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Etihad Airways.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Etihad Airways
Private
2026-06-27
90d ago
Silent
High
Etihad's app records your screen while you enter your passport details and make payments, and embeds a Chinese security tool capable of monitoring exactly those same screens, a tool that falls under China's intelligence law. It also reads every event in your device's calendar and starts tracking before you have given consent, on an airline based in the UAE with no approved EU legal basis for these transfers. Across seven messages over more than two months, nobody from Etihad ever replied.
com.mttnow.android.etihad v9.5.9, built by Mobile Travel Technologies (MTT) with Ernst & Young (EY). All seven findings re-scored under CVSS v4.0. CyberfEnd (CN), WebView monitoring active in the passport and payment entry flow, and Quantum Metric, session recording of the same passport, date-of-birth, frequent-flyer, and payment fields, both reach HIGH on their own computed CVSS scores, the fourth consecutive travel-sector app in this audit series found to embed CyberfEnd, after trivago, the Amadeus-branded Merci client, and Air Canada. Adobe Launch runtime tag loading, pre-consent Firebase init with a hardcoded key, and UAE-to-US transfers without an EU adequacy decision correct to MEDIUM, alongside a development tunnel domain left cleartext-enabled in the production network config. Undocumented full-device calendar read access corrects to LOW. Seven messages sent across 71 days, security@etihad.ae permanently full and privacy@etihad.ae bounced outright before dpo@, privacy@ (.com), and dataprivacy@etihad.ae accepted delivery. Not one reply of any kind was ever received. Case closed and published on the stated embargo date, 2026-09-25.
click to expand
GDPR Art. 44GDPR Art. 9
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.