Location Exposure via Messaging Apps

A newly discovered side-channel attack poses a risk to users of messaging apps like Signal, Discord, and Twitter, potentially revealing their approximate locations. The attack exploits a flaw in Cloudflare's content delivery network, which caches images sent through these platforms. Remarkably, an attacker could obtain location data simply by sending an image without requiring the target's interaction, as the attack can work through push notifications. While the information retrieved is coarse, typically indicating a general area such as a city or state, it emphasizes the importance of understanding how mobile applications manage data and the potential implications for privacy.