Cloned Data Exposed Across Seven Major Android Ecosystems
Changing a mobile device typically involves placing an old handset next to a new one to copy personal files, applications, and system configurations. During this local transfer process, however, critical privacy boundaries can collapse. The study, presented at ESORICS 2026 under the name Clone2Pwn, evaluated migration applications across seven smartphone brands and found problems in every single one of them.
The affected utilities include Google Switch, Samsung Smart Switch, Vivo EasyShare, Xiaomi Mi Mover, Oppo Clone Phone, Huawei Phone Clone, and Honor Device Clone. These applications collectively account for more than 12.000 millones de instalaciones. Many of them arrive pre-installed directly on consumer handsets, functioning as the default pipeline for moving a digital life from an aging piece of hardware to a fresh device.
Investigators discovered that these migration tools frequently establish a direct local Wi-Fi connection between the two mobile units. This bypasses external cloud servers to speed up data movement, but the underlying local communication protocols lacked adequate isolation. An unauthorized actor positioned within standard wireless range—measured between 20 and 45 meters indoors—could intercept or manipulate the transmission stream using equipment costing less than 100 euros.
High-traffic environments where many devices are initialized daily, such as commercial electronics stores, mobile carrier kiosks, and technical service centers, present the highest exposure risk. While a targeted attack in a private residential setting remains less probable, the research demonstrated that direct device-to-device radio links were far more permeable than standard user expectations suggest.
From Plaintext Photos to Deep System Manipulation
The breadth of exposed information extended far beyond casual photo libraries and chat logs. Testing revealed that an intercepted migration stream could surrender text messages, contacts, detailed call histories, sensitive health tracking metrics, Wi-Fi network credentials, and application-specific access tokens.
The severity rating was significant because the attack vector was not limited to passive eavesdropping. In specific test scenarios, researchers successfully manipulated application data packets mid-transfer. This capability introduced the potential for injecting malicious software directly into a brand-new device.
Migration software inherently requires elevated operating system permissions. Because these utilities must read into many parts of the system to transfer information that normally remains protected, any underlying weakness in the transit layer triggers disproportionately massive security repercussions. The broad trust granted to these applications makes them prime targets for local wireless intrusion.
Vendor Patches and the Immediate Pre-Transfer Protocol
Following a responsible disclosure process, the researchers notified all affected manufacturers prior to the public presentation of the study. Google, Samsung, Vivo, Xiaomi, Oppo, Huawei, and Honor have since developed and deployed security updates. Five of the reported vulnerabilities received high-severity classifications from the vendors.
Mitigating the risk requires targeted software maintenance. Depending on the manufacturer and device model, users must download the latest iteration of the specific migration application, apply pending firmware patches, or install recent operating system builds on both the source and target handsets.
Executing a device migration inside a retail store or service center magnifies environmental exposure. Checking for pending system updates on both devices before initiating any file transfer has become a recommended step for safely modernizing mobile hardware.
