Getting the data off the device is not straightforward, as network access is restricted unless the application has the correct permissions. Still, there is a way for attackers to surreptitiously steal your data.

"In my tests, I found that the app is able to launch the browser even after it has lost focus, allowing for transmission of large amounts of data by creating successive browser calls," Brodeur writes. In plain English, this means successive requests to open the browser and send strings of data can be done entirely in the background, so the victim never knows it's even happening.

For more tech news and commentary, follow Ed on Twitter at , on , or .