A system, method and program product for implementing an ultrasound security system for a mobile device. A system is described that that integrates with an operating system on a mobile computing device, and includes: an app flow analysis system that generates and maintains runtime flow graphs for apps running on the mobile device and analyzes the runtime flow graphs to identify a set of apps having confidential data flow application programming interfaces (APIs) in their execution paths; a detector that further evaluates the set of apps having confidential data flow APIs to identify a subset of vulnerable apps also having ultrasound emitting APIs; and a runtime correlation system that flags a vulnerable app as a potential data leak when a call to an ultrasound emitting API is detected from the vulnerable app. Also contemplated is a countermeasure system that broadcasts a temporal sound blocking signal to neutralize an ultrasound transmission from the vulnerable app.