Submit #850975: Meesho Meesho Android App Latest (com.meesho.supply) CWE-312 Cleartext Storage of Sensitive Information

During dynamic analysis using Frida, the Meesho Android application (com.meesho.supply) was found storing sensitive user Personally Identifiable Information (PII) in plaintext inside SharedPreferences.
Sensitive data exposed includes:

Full user details (USER key): user_id, phone number, email address, name
Extensive tracking data (super_properties)
Session information (APP_SESSION_EVENT)

Proof of Concept:
A custom Frida script (meeshobug2.js) hooks SharedPreferences.Editor.putString() and logs the following in real-time:
JavaScript[???? PII EXPOSED]
Key : USER
Value : {"user_id":149712167,"phone":"[phone]","email":"[email protected]","name":"Soyam Arya",...}

[???? PII EXPOSED]
Key : super_properties
Value : {"Phone":"[phone]", ...}
Full Frida script used:
JavaScriptJava.perform(function() {
// [Full script as provided earlier - I can paste the complete one if needed]
});
Impact:
Any attacker with physical access to the device can easily extract the user's personal information, phone number, email, and behavioral data. This leads to serious privacy violations, identity theft risks, and potential account compromise.
Root Cause:
Use of plaintext SharedPreferences instead of EncryptedSharedPreferences or Android Keystore.
Recommendations:

Implement EncryptedSharedPreferences with AES-256 encryption.
Store sensitive data in Android Keystore.
Minimize PII stored locally.

• Source: ⚠️ https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW
• User: honest_corrupt (UID 85229)
• Submission: 06/07/2026 11:40 (2 months ago)
• Moderation: 08/02/2026 22:44 (2 months later)
• Status: Accepted
• VulDB entry: 385419 [Meesho Online Shopping App up to 20260607 on Android com.meesho.supply user_id/phone number/email address/name cleartext storage]
• Points: 20