Update (March 13, 2026):

Several major developments since this was posted:

1. Packet Storm Security — Advisory published: https://packetstorm.news/files/id/217089

2. Apple Product Security — Confirmed forwarding to investigation team (Ticket OE01052449093014). Apple is actively investigating Alipay iOS app.

3. Google Play — Policy violation investigation confirmed (Case #9-7515000040640).

4. Singapore PDPC — Formal investigation opened (Case #00629724).

5. HKCERT — Forwarded report to CNCERT (China National CERT).

6. MITRE CVE — 6 CVEs pending (Ticket #2005801), CVSS 7.4–9.3.

Vendor (Ant Group) continues to maintain these are "normal functionality" and has issued no patch.

Full report: https://innora.ai/zfb/