Molly Signal fork remains vulnerable after months without updates

The Molly Signal fork has not been updated since July 31, leaving it with vulnerabilities that have already been patched in the mainline Signal application. The latest available version of the fork is v8.19.2-4. An exploit disclosed in October was fixed in Signal version 8.27.1, but this security fix remains absent from Molly. Consequently, users are recommended to delete the fork and use the mainline Signal app until updates resume.

Some users rely on the Molly fork specifically for UnifiedPush support, which allows them to receive notifications without Google Play Services. However, using MollySocket with UnifiedPush increases the attack surface for users who rarely use the application. Additionally, UnifiedPush requires a polling delay of about one minute for notifications to arrive. The original Signal APK from Signal's website does not require Google Play Services if it is not installed via the Play Store.

Signal now officially supports linking two Android devices to one account, a feature available since a month or so ago. For users on phones without Google Play Services or accounts, Signal can be used with MicroG. The Guardian Project also distributes the original Signal app on F-Droid, providing an alternative source for the secure messaging application.