Russia's mandatory Max app can read data from the services it hosts. Researchers described five capabilities but found no evidence of abuse

Six researchers from the University of Michigan, the University of Calgary, Georgia Tech, and the Indian Institute of Technology Delhi published an analysis on September 10 of Russia's Max app, which has had to be preinstalled on every phone and tablet officially sold in Russia since September 1, 2025. According to them, Max has five capabilities over the services it hosts inside itself: it can capture their screen image, read and even rewrite the data they store on the phone, inject its own code into them, monitor their network traffic, and control login in a way that lets it pose as the user themselves. The authors also write that they did not observe Max maliciously exploiting these capabilities. arXiv ↗

They tested ninety services hosted by the app

Max is a super-app modeled on China's WeChat: a single shell running dozens of smaller services — banking, government offices, transport, school. The researchers tested ninety of these so-called mini-apps from healthcare, public administration, banking, telecommunications, commerce, education, and tourism. They worked on rooted OnePlus phones using the Frida tool, which intercepts calls directly during program execution, and connected via both Russian and American networks. arXiv ↗

The Russian version of Max encrypts communication using the GOST TLS protocol under the Russian state standard, and common network-traffic analysis tools do not natively support it. The team therefore tapped in at the point where the text is still unencrypted. Capturing the image of a mini-app via the PixelCopy interface succeeded in 31 of 35 attempts, i.e. 88.5 percent, including transitional states such as a password being typed. arXiv ↗

For one of the five capabilities, the authors documented that Max actually uses it. It injects its own code into every loaded page, specifically a content-sharing add-on and a rendering-speed meter. These are harmless purposes, but it shows that the pathway is open and in active use. arXiv ↗

What matters, according to the authors, is that these capabilities are not a flaw of Max. They stem from how super-apps are built in general — the host naturally holds full power over the guest, and the guest has no way to verify what the host has inserted into it. They say Chinese WeChat and Iranian Bale have the same problem, and that it needs to be addressed at the level of mobile operating systems and app stores. arXiv ↗

Installation wasn't mandated for everyone, but many have no choice

Max is developed by VK, a company close to the Russian state, and launched in spring 2025. Mandatory preinstallation on new devices has applied since September 2025, and by summer 2026 Max had become the most-used messaging app in Russia. It grew in tandem with authorities restricting the competition: in late March 2026, when Telegram suffered major outages in Russia, daily installs of Max from the Google Play store climbed to nearly 2.9 million. That figure refers to installs, not active users. arXiv ↗ Le Figaro ↗

How Max was presented to the public is captured in a report by German public broadcaster DW from June 2025, a year and a quarter before this research was published. It is in English and runs twelve minutes.



Until then, Roskomnadzor had been strangling the competition piece by piece. Since August 2025 it had been restricting calls over WhatsApp and Telegram, citing the fight against phone scams as justification. The Moscow Times ↗ Then, on February 12, 2026, WhatsApp, owned by Meta, accused the Russian government of trying to block it entirely. The Moscow Times ↗

There is no mandate for the individual. The pressure comes through institutions. Officials, teachers, university students, and schoolchildren all had to move their communication to Max. A Moscow teacher told The Guardian that in March their principal called a meeting and announced that from then on, chats with parents and homework assignments would go through Max, and there was no real option to refuse. A student from St. Petersburg reluctantly downloaded the app just before the start of the academic year, after learning that without a QR code generated in it, they would not be let into university buildings or the dormitory. AGI ↗

According to the same newspaper, Russia's elite tends to use it mostly for show. A person close to the Kremlin said that they and several friends had bought a second phone just for Max, while continuing to use Telegram and Signal for everyday communication. Max has also not yet replaced Telegram as a news source — it has few public channels with a comparable audience. AGI ↗

The Union's sanctions came before the research

On July 13, 2026, the Council of the European Union added VK and its subsidiary Communication Platform, which manages Max, to the sanctions list under the human-rights-violations regime. In its reasoning, it stated that the app is under FSB oversight and that its surveillance functions were used for repression against people criticizing Russia's war against Ukraine or publishing otherwise banned content. For the sanctioned entities, this means a freeze on assets within the Union and a ban on making funds available to them. The Moscow Times ↗ Le Figaro ↗

This is the reasoning behind the Council's sanctions decision and stands separately from the technical analysis. The researchers describe what the app is capable of, not what the Russian state has been proven to do with it. Regarding screen capture, they explicitly state that they found no evidence that Max triggers it during normal use of the mini-apps. Moreover, the work has not yet undergone peer review. It is a preprint published on the arXiv server. arXiv ↗

Team lead Roya Ensafi told The Guardian that her group has been tracking Russian internet restrictions for ten years and that Max is "the cleverest and also the scariest tactic by authoritarian governments" for surveilling citizens. She called it "a blueprint any government can follow". The newspaper states that it contacted both Max and VK for comment. The Guardian ↗

*Illustrative photo: The Singer House on Nevsky Prospect in St. Petersburg, home to the VKontakte social network. Author: Perituss / Wikimedia Commons, CC0.*