Molly Signal fork unpatched for 3 months
Original: Molly (Signal fork) has not been updated since 3 months and is vulnerable
Why This Matters
Unpatched forks of security-critical apps put privacy-focused users at direct risk.
Molly, a privacy-focused fork of Signal for Android, has not released an update since July 31 (v8.19.2-4), leaving users exposed to vulnerabilities already patched in Signal 8.27 as of October 2024.
Molly, a Signal fork popular among privacy-focused Android users for its de-Googled build and UnifiedPush support, has not shipped an update since July 31, 2024 (version v8.19.2-4). In the months since, Signal's mainline app has patched at least one publicly disclosed exploit—fixed in Signal 8.27—that Molly users remain exposed to. The community post, cross-shared on the PieFed federated platform, recommends switching back to mainline Signal and uninstalling Molly until the project resumes regular updates. Discussion in the comments points to why users chose Molly in the first place: avoiding Google Play Services, getting push notifications via UnifiedPush, and side-loading without the Play Store. Alternatives suggested include using Signal's official APK at signal.org/android/apk paired with Obtainium for automated updates, or running Signal with MicroG on de-Googled ROMs like GrapheneOS. An Android developer in the thread noted that F-Droid's publishing process is notoriously difficult to maintain, saying it caused their own app to go three months without an update—hinting at a possible structural reason for Molly's delay.