https://www.info-sec.ca/advisories/Google-Cardboard.html

Google Cardboard Android & iOS Applications - Unencrypted Third Party 
Analytics

Overview

"Cardboard puts virtual reality on your smartphone. The Cardboard app 
helps you launch your favorite VR experiences, discover new apps, and 
set up a viewer."

(https://play.google.com/store/apps/details?id=com.google.samples.apps.cardboarddemo)
(https://itunes.apple.com/us/app/google-cardboard/id987962261)

Issue

The Google Cardboard Android & iOS applications (Android version 1.8, 
iOS version 1.2 and below) sends potentially sensitive information such 
as OS, CPU architecture, graphics chip vendor & version, CPU count, RAM, 
VRAM, screen size, device make and model, unencrypted to a third party 
site (Unity 3D Stats).

Impact

An attacker who can monitor network traffic could capture potentially 
sensitive information about the user's device without their knowledge.

Timeline

May 9, 2017 - Notified Google of the issue
May 9, 2017 - Google sent an auto acknowledgment
May 10, 2017 - Google responded stating that they are investigating
May 18, 2017 - Asked for an update
May 19, 2017 - Google acknowledged the issue
June 6, 2017 - Google provided the information to their development team
June 6, 2017 - Provided additional information to Google about the 
privacy considerations
June 8, 2017 - Google advised that they are working on the issue
July 5, 2017 - Asked for an update
July 6, 2017 - Google provided an update
July 20, 2017 - Asked for an update
July 24, 2017 - Google advised that they expect the applications will be 
updated in 2-4 months
November 20, 2017 - Asked whether the release is on schedule
November 24, 2017 - Google provided an update
December 13, 2017 - Asked for an update
December 14, 2017 - Google provided an update
May 28, 2018 - Asked for an update
June 8, 2018 - Google provided an update
August 24, 2018 - Notified Google of a planned disclosure date of 
November 1, 2018

Solution

The Google Cardboard Android & iOS applications as of November 1, 2018 
are affected.