5 popular Android apps I wouldn’t trust in 2026

5 popular – A veteran Android security voice argues that download counts can be misleading—and points to five widely used apps that raise privacy or security concerns, or duplicate protections Android already offers.

On the Play Store, those download numbers are loud. They make apps look proven, safe, even inevitable. But a lot of users—especially anyone shopping for “free” protection—are getting judged by the wrong metric.

This is the argument behind a warning aimed at five extremely popular Android apps people keep installing in the hope they’re adding safety and convenience. The pushback isn’t that every app is outright malicious. It’s that some choices come with privacy costs, shaky security histories, or unnecessary permissions. And in other cases, Android already covers the job these apps claim they’re doing.

Turbo VPN
Turbo VPN is the kind of app that looks like a safe bet at first glance: it has over 500 million downloads on the Play Store and it’s free. It also does what you expect from a VPN.

But the issue raised with Turbo VPN is that free VPNs “almost always have a catch.” Beyond the annoyance of ads in Turbo VPN’s free tier, the criticism is about data practices and connections described as ties to China-based entities, based on reports over the years.

The central concern is simple: running a VPN service isn’t cheap. If users aren’t paying with money, the app’s profits have to come from somewhere else—meaning the privacy you’re trying to protect may end up being the trade.

LastPass
A password manager lives and dies on trust. LastPass used to be a top name among users and security experts, but the warning here is that trust hasn’t held up.

The specific reason is LastPass’s security track record, with its 2022 breach described as especially serious. In that incident, attackers stole customer data and even gained access to LastPass’s security architecture.

The complication isn’t that breaches happen—no password manager is “completely immune.” The concern is that the 2022 breach is framed as not being isolated.

Truecaller
Truecaller offers something most people recognize instantly: it identifies unknown callers, blocks spam, and can prevent yet another telemarketing interruption.

It also has massive reach. On the Play Store alone it has more than a billion downloads, and it’s available on iOS.

The catch comes down to what happens when you sign up. Truecaller isn’t only collecting your information; it uses information from its users to build a large database. meaning it can include data about people who never chose to install the app. That means someone who has never heard of Truecaller could still have their name and phone number listed in its database.

There’s also the permissions question. Truecaller asks for access not just to contacts, but also call logs, messages, location, files, photos, videos, and audio. Some are optional, but the overall breadth is flagged as difficult to feel comfortable with.

The final point in this thread is that Truecaller filled a real gap a few years ago—but Android now handles spam calls and messages much more effectively.

CCleaner
CCleaner is positioned as a storage-cleaning app that claims to remove junk files and unnecessary data, and it can also spot apps consuming too many resources.

The complaint is that modern Android phones don’t need a separate app to do most of this. Android already shows which apps drain battery or use excessive mobile data through the settings menu. There’s also Google’s built-in Files app. which includes a dedicated cleanup tab for removing junk files. duplicate photos. old screenshots. and unused apps—and unlike CCleaner. it’s completely free.

The warning doesn’t label CCleaner as “bad,” but it argues it’s trying to solve a problem that no longer needs solving. It also takes issue with how aggressively the app pushes its subscription to get users to try some useful features.

AVG AntiVirus & Security
Antivirus apps on the Play Store are easy to find, and AVG AntiVirus & Security is marketed as offering malware protection plus extra tools like privacy tools, app locking, Wi‑Fi security checks, and performance-optimization features.

The pushback is that antivirus apps like this are largely unnecessary on Android. Google Play Protect is described as continuously scanning every app on a phone—including apps installed via sideloading—for harmful behavior. If it detects something suspicious, it can warn the user and even automatically remove the app.

The argument also points to Android Safe Browsing, which scans for malicious links in real time to help protect against viruses and phishing scams.

In this framing, AVG and most Android antivirus apps duplicate features Android already provides—and worse, they charge for them. The bottom line is that as long as people stick to the Play Store and don’t deliberately disable Android’s built-in security features. the risk of a phone getting infected generally isn’t something users need to fear.

The thread lands on a theme that’s hard to ignore: popularity doesn’t automatically mean safety, and convenience doesn’t always come free—especially when an app’s “help” depends on access to far more data than you might expect.

Android apps privacy security Turbo VPN LastPass breach 2022 Truecaller permissions CCleaner subscription AVG AntiVirus Play Protect Android Safe Browsing