Yikes: Google let a fake Chrome app on the Play Store, and it got over 100,000 downloads

Google talks a big game about trying to keep the Android ecosystem safe and secure. The company recently started cracking down on sideloading apps because malicious actors can easily create fake apps and trick users into installing them. Instead, Google wants users to install apps directly from the Play Store.

The idea is that installing apps from the Play Store pretty much guarantees you won’t install a fake or malicious app. However, Google doesn’t seem to be doing a stellar job of keeping the Play Store safe, either.

According to a post on Reddit (via PiunikaWeb), a fake version of Google Chrome was available for download on the Play Store. While that is surprising by itself, this fake Chrome app already had over 100,000 downloads and apparently paid its way to the top of the search results for “Chrome.” A screenshot in the Reddit post shows the fake Chrome app, from a developer named “Hizbartech,” appearing above the actual Chrome app from Google.

There are two important points to consider here. First, how did Google miss this in its usual app review practices before letting the app go live on the Play Store? Second, and more surprisingly, Google also let the developer pay to advertise the app on the Play Store — an app that clearly tried to trick people into thinking it was the real Chrome browser, and apparently succeeded at least 100,000 times.

Fortunately, the app seems to have been removed from the Play Store. However, this raises questions about Google’s security practices for apps on the platform. The company raises doubts about unverified developers on the one hand, yet lets clearly misleading apps into the Play Store on the other.

In the case of Hizbartech’s Google Chrome app, it was originally uploaded to the Play Store as a game called “Ball Bounce.” The developer later changed its name and app icon to Google Chrome. Based on a comment on the original Reddit post, the app was actually neither. It was apparently a chat app with canned responses and nothing else.

The timing of this fake app’s upload is ironic, too. Google announced its new “advanced flow” for sideloading apps on August 18. Ball Bounce appeared on the Play Store on August 22 and was updated to “Google Chrome” on September 30. That just goes to show that no app store is truly safe, that sideloading is not the problem, and the real solution is for users to be more vigilant. Next time you see an app on the Play Store, maybe double-check the developer’s name and the package name before you install it.

We have reached out to Google for a statement and will update this article when we hear back.