MegaGlass 0.2.0

Alpha release for Android 15 and later (arm64-v8a). This release fixes the problems that a full security and code review found before the first users.

Security

• Other apps can no longer connect to the media session, read the play queue or stream your files.
• MediaInfoLib 26.10 fixes four heap overflows in the media parser that runs on uploads and downloads (CVE-2026-28764, CVE-2026-25104, CVE-2026-25713, CVE-2026-22554).
• Files shared from other apps are read only through the access that the other app gave.
• Biometric unlock is bound to a Keystore key, so a newly enrolled fingerprint or face does not unlock the app. Changing the passcode, the lock timeout or biometric unlock asks for the current passcode.
• Camera uploads no longer include the GPS location.
• File names with bidi or control characters are shown and saved without these characters.

Data safety

• Syncs pause when All files access is removed, so the cloud copies are not deleted.
• Albums open correctly. Before, about half of the albums opened empty.
• Restore from the Rubbish bin does not overwrite a file with the same name.
• Actions on many items finish when you leave the screen.
• The text editor keeps your edits until the save is done.
• Captured photos are kept when the upload does not start.

Other fixes

• Transfers continue after short network drops. Cancelling one download cancels only that file.
• Camera uploads respect Wi-Fi only and charging.
• A crafted PDF no longer crashes the viewer.
• Many smaller fixes.

License

MegaGlass is now GPL-3.0. The third-party notices are in About.

Verify the APK

• SHA-256: f7a0c258516bad89358c61c309ffeca073946dad1e282e9b4d10899b193bba1b
• Signing certificate SHA-256: 84c7ed6935e18d6e6aebc6e3c490e3aa5468974ee856baf1df979bda3c7b5241

Workflows that need a MEGA account (login, transfers, offline, camera uploads) have not been tested end to end with a live account yet.