Signal fork Molly goes 3 months without updates, leaving users exposed to vulnerabilities
Molly, a popular hardened fork of the Signal messaging app favored by privacy-conscious Android users, has not received any new release since July 31, when version v8.19.2-4 shipped. That means the app has now gone roughly three months without updates; a dangerous gap in a field where security patches arrive quickly. During that window, several vulnerabilities have been discovered and quietly fixed in mainline Signal, but Molly users remain exposed to all of them.
The most striking example is a bug disclosed in October, in which audio, and possibly video, could continue transmitting after an Android user ended a call. Official Signal patched the flaw in version 8.27, but because Molly has not incorporated those upstream changes, the fork remains vulnerable. Security observers note this incident illustrates a broader risk of relying on third-party clients: whenever a fork lags behind its upstream project, users inherit every unpatched bug in the meantime. Some commenters also pointed out the episode explains why Signal itself has historically been wary of third-party clients, however well-intentioned.
Until Molly resumes updating its app at a pace that keeps up with mainline Signal's security fixes, the recommendation from security watchers is straightforward: switch back to the official Signal client and remove Molly from your device. Whether the project will return to regular releases, and when, remains unclear.
Comments
Molly struggles to keep up with all Signal recent patches (mostly AI discoveries, that naturally hits small sized forks harder than very large projects), not that it should be used as an excuse (Molly has about $45k on Open Collective, more than enough to offer premium support). Now, Signal doesn't mandate the use of Google services, push notifications can be forced only thought websocket, and the other few functionalities, like location sharing, would just won't be available without affecting messages sharing and video calls. Molly may be less useful nowadays that it was released back in 2020.
$45k will pay for one junior developer and blead the coffers dry in a year, that's not a sustainable solution.