Privacy Glitch in Snapchat Web Exposed Notification Leak After Logout


Affected Feature

Snapchat Web's notification system. When logged into Snapchat on a browser, you get notifications for incoming snaps and video calls.

How to Reproduce

  1. Log into Snapchat Web on Chrome
  2. Change your Snapchat password from the mobile app (this forces logout on all sessions)
  3. Verify the web session logged out properly
  4. Notifications for snaps and video calls still keep coming to the browser

Even though the session is terminated, the notification channel stays active. I recorded a video showing notifications arriving in real-time on a logged-out session.

Company Response

Reported through Snapchat's bug bounty program. Initially marked "Informative" because they thought it required physical access and wasn't a real threat. I pushed back explaining users expect full logout means no notifications either. They eventually agreed and fixed it - notifications now properly stop when you log out of Snapchat Web.


Comments

Post a Comment

Popular posts from this blog

When an AI Search Engine Forgot Who It Was: A Bug Report That Changed Perplexity AI’s Identity

Image
Affected Feature Perplexity AI's conversational response system across both Chrome extension and mobile app. When users ask comparative questions about Perplexity itself, the system should respond from its own identity as a search engine. How to Reproduce Open Perplexity AI (Chrome extension or mobile app) Ask: "Are you better than Google?" The response compares ChatGPT to Google instead of Perplexity to Google Perplexity acts like it's ChatGPT, completely ignoring its own identity as a search engine Same bug happened on both the extension and app - identical confused responses about ChatGPT vs Google. Impact This is a product logic bug that creates an identity crisis. Users asking about Perplexity get answers about ChatGPT, making them think Perplexity is just a ChatGPT wrapper instead of its own search engine. The LLM powering Perplexity couldn't recognize that "you" in the question meant Perplexity itself. It associated "better than Google...
Read more

Understanding Android’s One-Time Permissions and Their Privacy Implications

Image
You know that moment when you carefully set an app's permissions to "Ask every time"? When you go into Settings, find that app, and make sure it only gets access to your microphone or camera when you explicitly allow it? You feel good about it. You're in control, right? Yeah, about that. I've been testing Android's one-time permission system, particularly with apps like WhatsApp. I set the microphone permission to "Ask every time" because I wanted tight control over when the app could listen. But what I discovered was something that doesn't quite match what Android's documentation promises. Guess what? There's a gap. A small one, but it matters. Wait, How Does This Work? Here's the thing most people don't know: when you close an app after granting one-time permission, Android doesn't always revoke it instantly. Think about it. You finish a WhatsApp call, swipe the app away from your recent apps, and assume that's it...
Read more

Your Android Phone's Dirty Little Secret - Gemini

Image
You know that moment when you're careful about app permissions? When you go into Settings, find that sketchy app, and revoke its access to your camera, location, or files? You feel good about it. You're in control, right? Yeah, about that. I've been using Google Gemini since it launched. I gave it access to pretty much everything - camera, files, location, the works. Recently, I decided to clean things up. Went into Android settings, revoked all of Gemini's permissions, deleted the app, and reinstalled it fresh. Guess what? Gemini still had access to everything. Wait, How Is That Even Possible? Here's the thing most people don't know: Gemini doesn't actually need your permission if you've already given it to the Google app. Think about it. The Google app comes pre-installed on almost every Android phone. During setup, you probably granted it a bunch of permissions without thinking twice. Camera, microphone, location, files - whatever it asked for,...
Read more