LinkedIn (com.linkedin.android): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for LinkedIn.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
LinkedIn
NYSE
2026-06-23
93d ago
CS deflect
High
The EU version of the LinkedIn app has three tracking addresses pointing to Chinese servers built directly into its code, servers that fall under China's national-security law with no EU legal safeguard covering the transfer. The app also automatically logs your professional activity to Facebook with no clear legal basis. When RFI-IRFOS reported this, LinkedIn redirected the complaint five separate times, through a satisfaction survey, its bug-bounty platform twice, an account-troubleshooting ticket, and finally its own legal inbox, which auto-replied asking not to be contacted again, all without a single human actually engaging with any finding.
Three hardcoded Chinese tracking endpoints (linkedin.cn / linkedin-ei.cn / linkedin-ei2.cn) compiled into the production Android telemetry pipeline, CVSS v4.0 base MEDIUM/6.9, held at HIGH under blast-radius escalation (950M+ members). Facebook SDK auto-logging professional behavioral events, also corrected to CVSS-based HIGH. 18 cultural-identity profiling aliases corrected to MEDIUM (selection logic not independently confirmed). Hardcoded Google/Firebase keys, MEDIUM. Five distinct deflection layers followed, each named for the record: (1) Customer Service Redirect, Case #260623-005474; (2)+(3) HackerOne Redirect, twice; (4) Account Support Ticket, screenshots requested for a GDPR disclosure; (5) Legal Inbox Auto-Deflect, asked not to write again. Case closed and published 2026-09-24, two days after the 2026-09-22 embargo.
click to expand
GDPR Art. 44GDPR Art. 13(1)(e)GDPR Art. 9(1)
Yes
Closed
Disclosure
93d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.