Summary
Frothly engaged Pauley & Finn Security to audit Glossia 4.0 before its public release. Over nine weeks between July and September 2026, we reviewed the protocol specification, the reference clients for Android, iOS and desktop, and the relay software that carries messages between them.
We found no critical or high-severity issues. We reported three moderate and seven low-severity issues; all three moderate issues and five of the low-severity issues were fixed before release, and Frothly has documented its reasons for accepting the remaining two. In our assessment, Glossia 4.0 meets its published security goals.
0
Critical or high-severity issues
3
Moderate issues, all fixed before release
7
Low-severity issues: 5 fixed, 2 accepted
2.1B
Fuzzing test cases executed
Issues reported
| Identifier | Severity | Issue | Status |
|---|---|---|---|
| GL4-M1 | Moderate | Relays accepted malformed padding, allowing message sizes to be inferred | Fixed |
| GL4-M2 | Moderate | Desktop client kept decrypted attachments in a temporary folder longer than necessary | Fixed |
| GL4-M3 | Moderate | Key-transparency client did not pin the log’s signing key on first use | Fixed |
| GL4-L1 | Low | Verbose relay logging recorded connection times at full precision | Fixed |
| GL4-L2 | Low | Android client allowed screenshots of the safety-number screen | Fixed |
| GL4-L3 | Low | Session resumption tokens did not expire on device unlink | Fixed |
| GL4-L4 | Low | Group invitations revealed member count before acceptance | Fixed |
| GL4-L5 | Low | Specification ambiguity in the downgrade-protection section | Fixed |
| GL4-L6 | Low | Delivery timing can reveal when a contact is online | Accepted |
| GL4-L7 | Low | Push-notification providers learn when a device receives a message | Accepted |
Our response
We fixed every moderate issue, and five of the seven low-severity issues, before Glossia 4.0 was released. The auditors verified each fix against the release builds. The two accepted issues concern delivery timing and push notifications; for people who need the strongest protection, Glossia offers an optional random delivery delay and a mode that turns push notifications off entirely.
Glossia is audited independently every four years and after every major version. We publish every report in full, including the findings we would rather not have had.