# DVMA — Damn Vulnerable Mobile App

> A single-codebase, intentionally vulnerable Flutter app for mobile security training and pentest practice. It ships 218 intentional vulnerability modules across 15 OWASP MASVS categories, each mapped to the OWASP Mobile Top 10 (2024), MASVS/MASTG, CWE, and the OWASP Top 10 for LLM/GenAI and Agentic applications (2025). Every module produces a real, device-extractable artifact on Android and/or iOS.

## Guides

- [Home](https://cpeoples.github.io/dvma/): project overview, what's inside, and quickstart.
- [Getting Started](https://cpeoples.github.io/dvma/getting-started/): install Flutter, build DVMA, and run it on a device or emulator.
- [Architecture](https://cpeoples.github.io/dvma/architecture/): how the Flutter UI, native host, and companion attacker app produce real artifacts.
- [Dashboard](https://cpeoples.github.io/dvma/dashboard/): coverage matrix by category and difficulty.
- [Vulnerabilities](https://cpeoples.github.io/dvma/vulnerabilities/): the full catalog, by category.
- [Manual Testing](https://cpeoples.github.io/dvma/manual-testing/): external-tool verification steps (MITM, Frida, drozer, static analysis).
- [Root & Jailbreak](https://cpeoples.github.io/dvma/device-access/): root a Pixel (Magisk) or jailbreak iOS, then recover on-device artifacts.
- [Contributing](https://cpeoples.github.io/dvma/getting-started/contributing/): standards mapping and validation gates for new modules.

## Insecure Data Storage

- [Clipboard Leakage of Sensitive Fields](https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_leakage/): Copies passwords/tokens to the global clipboard readable by any app.
- [Insecure Backups (allowBackup / unencrypted iOS backups)](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_backups/): android:allowBackup=true and no iOS backup exclusion leak app data to backups.
- [Insecure Local Storage (Plaintext SharedPreferences/UserDefaults)](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_local_storage/): Auth token and PII written to SharedPreferences/UserDefaults in cleartext.
- [Insecure SD-Card / External Storage](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_sdcard_external_storage/): Writes sensitive files to shared/external storage where any app with storage access can read them.
- [Screenshot / Task-Switcher Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/screenshot_taskswitcher_leakage/): Sensitive screen rendered into the app-switcher snapshot with no FLAG_SECURE.
- [Sensitive Data in Crash Reports](https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_crash_reports/): Secrets, tokens, PII, or full request/response bodies survive into crash / diagnostic reports (Crashlytics/Sentry breadcrumbs, exception messages, attached…
- [Sensitive Data in Logs](https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_logs/): PII, tokens, and passwords printed to system logs.
- [Authentication-State Rollback / Restore](https://cpeoples.github.io/dvma/vulnerabilities/detail/auth_state_rollback_restore/): The app treats a locally-persisted session/token as authoritative and never checks freshness/revocation server-side, so restoring an OLD local state (from a…
- [Keyboard Cache & Autofill Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/keyboard_cache_autofill_leakage/): Sensitive text fields allow keyboard caching / autofill of secrets.
- [Keychain/Keystore Misuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_keystore_misuse/): Secrets stored without hardware-backed protection / with weak accessibility flags.
- [Local Security-State Integrity Tampering](https://cpeoples.github.io/dvma/vulnerabilities/detail/local_security_state_integrity_tampering/): A security decision (authenticated?, role, jailbreak-check result, purchase entitlement) is driven by a locally-persisted value in…
- [Temp / Cache File Leftovers](https://cpeoples.github.io/dvma/vulnerabilities/detail/temp_file_leftovers/): Decrypted/sensitive content written to temp/cache dirs and never cleaned up.
- [Third-Party SDK Data Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/third_party_sdk_data_leakage/): A stand-in analytics SDK phones home more data than its stated purpose.
- [Backup Archive Integrity Tampering](https://cpeoples.github.io/dvma/vulnerabilities/detail/backup_archive_integrity_tampering/): The app does not verify the INTEGRITY of a backup archive before restoring it, so an attacker extracts a backup, edits persisted state (entitlements, balances…
- [Keychain Access-Group Authorization Confusion](https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_access_group_authorization_confusion/): Over-broad kSecAttrAccessGroup / a shared access group / synchronizable or wrongly-scoped accessibility flags let another app, extension, or user read Keychain…
- [Keychain State Integrity Manipulation](https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_state_integrity_manipulation/): The app TRUSTS a Keychain/Keystore item as authoritative but a local attacker can MODIFY that stored state (not merely read it), so tampering with the item…
- [Sensitive Data in Memory](https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_memory/): Passwords/keys are held in long-lived, never-cleared objects, recoverable from a process memory dump.

## Insufficient Cryptography

- [Hardcoded Keys & Static IVs](https://cpeoples.github.io/dvma/vulnerabilities/detail/hardcoded_keys_ivs/): Symmetric key and IV baked into the binary; IV reused across messages.
- [Weak Cryptographic Algorithms (MD5/SHA1/DES/RC4/ECB)](https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_algorithms/): MD5/SHA1 for password hashing and DES/RC4/AES-ECB for encryption.
- [Custom / Homegrown Crypto](https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_crypto_implementation/): A homegrown XOR-based 'encryption' scheme trivially reversible.
- [Device Secure Lock Not Enforced for Sensitive Storage](https://cpeoples.github.io/dvma/vulnerabilities/detail/device_secure_lock_not_enforced/): A secret is persisted without requiring a device secure lock (PIN/passcode/biometric) or binding the key to it, so on a device with no lock screen the secret…
- [Improper MAC Verification (non-constant-time / unauthenticated)](https://cpeoples.github.io/dvma/vulnerabilities/detail/improper_mac_verification/): A signed token's HMAC is verified with a short-circuiting string equals (==) instead of a constant-time compare, leaking a timing oracle; a companion path…
- [Insecure Randomness (predictable tokens/session IDs)](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_random/): Uses Random() instead of Random.secure() for tokens/session IDs.
- [RSA Without OAEP Padding](https://cpeoples.github.io/dvma/vulnerabilities/detail/rsa_no_oaep_padding/): A payload is RSA-encrypted with legacy PKCS#1 v1.5 padding instead of OAEP, exposing it to Bleichenbacher-style chosen-ciphertext padding-oracle attacks; the…
- [Unauthenticated Encryption (malleable ciphertext / bit-flipping)](https://cpeoples.github.io/dvma/vulnerabilities/detail/unauthenticated_encryption_malleable_ciphertext/): A token is encrypted with AES-CBC and no MAC, so an attacker who never learns the key flips a ciphertext byte to predictably change the decrypted plaintext…
- [Weak Key Derivation (no/low PBKDF2 iterations)](https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_key_derivation/): Derives keys from passwords with missing or trivial KDF iteration counts.
- [Improper Signature Verification (payload not bound)](https://cpeoples.github.io/dvma/vulnerabilities/detail/improper_signature_verification/): An RSA-SHA256 signed update blob is accepted because the app only checks a signature is present and well-formed, never that it binds to the payload; an…

## Insecure Authentication / Authorization

- [Developer Backdoor](https://cpeoples.github.io/dvma/vulnerabilities/detail/developer_backdoor/): A hidden hardcoded backdoor credential / debug route grants privileged access.
- [Username Enumeration](https://cpeoples.github.io/dvma/vulnerabilities/detail/username_enumeration/): Login returns distinguishable responses for valid vs invalid usernames, allowing account enumeration.
- [Weak / No Password Policy](https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_password_policy/): Accepts single-character passwords; no complexity or length checks.
- [Client-Side-Only Authorization](https://cpeoples.github.io/dvma/vulnerabilities/detail/client_side_only_authorization/): Admin-only actions gated purely by a client-side boolean flag.
- [Cross-App OTP / Credential Leak](https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_otp_credential_leak/): A co-resident malicious app can read OTP codes / auth deep links from this app via an unprotected exported component, broadcast, or shared clipboard…
- [Deep Link Authentication Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_authentication_bypass/): A deep link routes directly to an authenticated screen/function, skipping the app-lock / login gate the normal navigation path enforces (Groww CVE-2026-12065…
- [Insecure / Bypassable Biometric Prompt](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_biometric_prompt/): Local auth is event-bound UI only; failure path is trivially bypassed.
- [Insecure Credential Manager / Autofill Integration](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_credential_manager/): Misuses the Android Credential Manager / iOS AutoFill: associates credentials with an unverified domain and lets autofill cache secrets into insecure fields.
- [Insecure Password Reset Token / Magic Link](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_password_reset_token/): Password-reset tokens / magic-login links are short, predictable, and never expire.
- [JWT Vulnerabilities (alg:none, weak secret)](https://cpeoples.github.io/dvma/vulnerabilities/detail/jwt_vulnerabilities/): Accepts alg:none tokens and verifies with a weak, guessable secret.
- [Multi-Account Isolation Failure](https://cpeoples.github.io/dvma/vulnerabilities/detail/multi_account_isolation_failure/): Switching accounts (or logging out and into account B) does not fully clear account A's cached credentials, tokens, keys, or on-disk/in-memory data, so account…
- [Passkey Credential Exfiltration](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_credential_exfiltration/): Passkey/credential material is cached in app-private storage without hardware-backed protection, allowing extraction.
- [Passkey Registration/Deletion Authorization Missing](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_credential_management_authz/): Passkey register/replace/delete endpoints don't re-authorize the acting user, so an attacker can add their own passkey or delete the victim's, causing account…
- [Passkey Fallback / Downgrade Attack](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_fallback_downgrade/): Passkey auth silently falls back to a weak password/OTP path an attacker can force (authentication downgrade).
- [Session Fixation After WebAuthn Assertion](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_session_fixation/): The session identifier is not rotated after a successful passkey assertion, so a pre-set (attacker-known) session id remains valid post-login (session…
- [Passkey Weak / No Attestation Verification](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_weak_attestation/): Accepts WebAuthn/passkey registrations with 'none' attestation and never verifies the authenticator attestation statement.
- [Weak Session Management](https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_session_management/): Sessions never expire and use predictable, incrementing tokens.
- [Biometric Result Not Bound to Operation](https://cpeoples.github.io/dvma/vulnerabilities/detail/biometric_authorization_not_bound/): The biometric prompt returns a boolean success that is NOT cryptographically bound to the specific operation being authorized (no CryptoObject / no signed…
- [Credential Provider Release Authorization Failure](https://cpeoples.github.io/dvma/vulnerabilities/detail/credential_provider_release_authorization/): A credential-provider / password-manager extension releases a stored credential or passkey assertion without validating the calling app / relying-party…
- [Identity Credential / mDL Presentation Not Bound](https://cpeoples.github.io/dvma/vulnerabilities/detail/identity_credential_presentation_binding/): A verifier accepts a digital-identity presentation (mDL/mDoc via Identity Credential / ISO 18013-5, or a Wallet identity assertion) without binding it to THIS…
- [OAuth Misconfiguration (implicit flow token leakage)](https://cpeoples.github.io/dvma/vulnerabilities/detail/oauth_misconfiguration/): Implicit-flow access token leaks via redirect URL and logs.
- [Passkey Assertion Replay (Sign-Count Not Enforced)](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_assertion_replay_signcount/): The authenticator sign-count / credential counter is never persisted or compared, so a captured WebAuthn assertion replays to create additional authenticated…
- [Passkey Challenge Reuse / Not Bound](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_challenge_reuse/): The server challenge is static / reused / never bound to a single ceremony, so a recorded assertion for one challenge is accepted again (assertion replay via…
- [Passkey Origin / RP-ID Binding Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_origin_binding_bypass/): rpId/origin is not properly validated, so a passkey assertion is accepted across origins (relying-party confusion).
- [Passkey Step-Up Authentication Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_stepup_auth_bypass/): A sensitive action's 'step-up verified' flag is set from the mere existence of a registered passkey instead of a completed assertion, so step-up is satisfied…
- [Third-Party Authenticator / Cross-Device Pairing Authorization Missing](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_thirdparty_pairing_authz/): Third-party authenticator / cross-device passkey-entry pairing is approved without a permission/authorization check, so an unauthorized app or device is paired…
- [Passkey User-Verification (UV) Enforcement Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_user_verification_bypass/): A configured userVerification=REQUIRED is silently not enforced, so assertions with the UV flag unset (presence-only) are accepted (Spring Security…

## Insecure Communication

- [Cleartext Traffic Allowed](https://cpeoples.github.io/dvma/vulnerabilities/detail/cleartext_traffic_allowed/): App sends requests over plain HTTP; cleartext permitted in manifest/plist.
- [Accept-All TrustManager](https://cpeoples.github.io/dvma/vulnerabilities/detail/accept_all_trust_manager/): Custom certificate callback accepts any certificate.
- [Insecure WebView Networking](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_webview_networking/): WebView ignores network security config and loads mixed/cleartext content.
- [Weak / Outdated TLS Config](https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_tls_config/): Negotiates deprecated TLS versions / weak cipher suites.
- [SSL Pinning (Trivially Bypassable)](https://cpeoples.github.io/dvma/vulnerabilities/detail/ssl_pinning_bypass/): Pinning is implemented but disabled by a client-side flag / easy hook.

## Improper Platform Usage

- [Activity-Alias Exposure](https://cpeoples.github.io/dvma/vulnerabilities/detail/activity_alias_exposure/): A protected/internal Activity is left reachable through an <activity-alias> that is exported=true (or lacks the target's permission), so an attacker launches…
- [Missing FLAG_SECURE (screen recording exposure)](https://cpeoples.github.io/dvma/vulnerabilities/detail/missing_flag_secure/): Sensitive screen allows screenshots/recording (no FLAG_SECURE).
- [Over-Privileged Permissions](https://cpeoples.github.io/dvma/vulnerabilities/detail/over_privileged_permissions/): Requests broad permissions unrelated to app functionality.
- [Over-Broad Media Access (no scoped photo picker)](https://cpeoples.github.io/dvma/vulnerabilities/detail/photo_picker_over_access/): Requests full media/photo-library permission instead of the modern scoped photo picker, over-collecting user photos.
- [Predictive Back / Recents Snapshot Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/predictive_back_leakage/): Android 14+ predictive-back / recents snapshot captures a sensitive screen because it is not marked secure.
- [Push Notification Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/push_notification_leakage/): Sensitive data placed directly in notification payloads / lockscreen.
- [QR Scanner -> URL With No Validation](https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_url_no_validation/): A scanned QR code's payload is treated as a trusted URL/deeplink and opened/navigated without validation (Firefox iOS QR-scanner CVE-2025-54145 class).
- [App Clip Invocation Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/app_clip_invocation_injection/): An App Clip acts on its invocation parameters (invocation URL / NFC / QR / associated-domain payload) - performing a purchase, order, or account action - while…
- [Background Activity Launch Abuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/background_activity_launch_abuse/): An untrusted / local caller drives a background component to startActivity() reaching security-sensitive UI, so with no background-activity-launch restriction…
- [Clipboard Unauthorized Write / Integrity Tampering](https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_unauthorized_write_integrity/): Untrusted content (a page loaded in the app's WebView, or another app) can OVERWRITE the system clipboard through the app with no user gesture / origin check…
- [ClipData URI-Grant Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/clipdata_uri_grant_leakage/): The app attaches a private content:// URI to an Intent's ClipData (or copies it) together with FLAG_GRANT_READ_URI_PERMISSION and fires it to an implicit /…
- [ContentProvider File-Import Filename Path Traversal](https://cpeoples.github.io/dvma/vulnerabilities/detail/contentprovider_filename_path_traversal/): A ContentProvider / file-import API takes the caller-supplied display name / filename and writes or reads it under the app's storage with no canonicalization…
- [Custom / Signature Permission Squatting](https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_signature_permission_squatting/): An IPC component is 'protected' by a custom permission whose protectionLevel is normal/dangerous (not signature), or by a permission name a malicious app can…
- [Custom URL Scheme Authorization (arbitrary URL load)](https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_url_scheme_authorization/): A custom URL-scheme handler loads a caller-supplied URL without checking the caller or an allowlist, so any co-resident app can make DVMA display an attacker…
- [Deep Link -> Trusted WebView Navigation](https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_to_webview_navigation/): A URL parameter from an incoming deep link/intent is loaded straight into a trusted WebView with no origin allowlist, so an attacker renders arbitrary content…
- [Deep Link / URL Scheme Hijack](https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_url_scheme_hijack/): Custom scheme is unvalidated and can be claimed/abused by another app.
- [Default-Role / Role-Holder Confusion](https://cpeoples.github.io/dvma/vulnerabilities/detail/default_role_holder_confusion/): The app resolves a system role (default browser / dialer / SMS / wallet / credential provider / NFC handler) with resolveActivity() / an implicit intent and…
- [Document Picker -> Trusted-File Confusion](https://cpeoples.github.io/dvma/vulnerabilities/detail/document_picker_trusted_file_confusion/): The app assumes a file returned by the system document / file picker (or a security-scoped URL) is trustworthy simply because the OS handed it over, and feeds…
- [Dynamic BroadcastReceiver Exposure](https://cpeoples.github.io/dvma/vulnerabilities/detail/dynamic_broadcast_receiver_exposure/): A runtime-registered receiver (registerReceiver() without RECEIVER_NOT_EXPORTED / a signature permission) is implicitly exported, so any co-resident app can…
- [Exported Android Components](https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_android_components/): Activities/services/receivers exported with no permission checks.
- [Exported Component -> Arbitrary URL / Activity Launch](https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_component_arbitrary_url_activity/): An exported component takes an attacker-supplied URL/activity target and opens it with the app's identity/privileges (ABEMA CVE-2024-28745 / Samsung Members…
- [Exported Component -> Unauthorized State Manipulation](https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_component_state_manipulation/): An exported component accepts an attacker-controlled identifier in its intent extras and performs a security-sensitive STATE CHANGE (e.g. cancelling the…
- [Handoff / NSUserActivity Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/handoff_useractivity_injection/): The receiving app restores state from a Handoff NSUserActivity (userInfo / webpageURL) and TRUSTS it - navigating, mutating state, or acting on an…
- [Implicit Intent Leaks Sensitive Data](https://cpeoples.github.io/dvma/vulnerabilities/detail/implicit_intent_sensitive_data/): Sensitive data is placed on an implicit intent (no explicit component/package), so any co-resident app registering a matching filter receives it (Samsung Smart…
- [In-App Browser UI / Address-Bar Spoofing](https://cpeoples.github.io/dvma/vulnerabilities/detail/inapp_browser_ui_spoofing/): An in-app WebView browser derives the displayed origin/address-bar from attacker-controllable content instead of the real committed URL, enabling website…
- [Incoming-Call Metadata Read (Missing Authorization class)](https://cpeoples.github.io/dvma/vulnerabilities/detail/incoming_call_metadata_missing_authorization/): A provider path returns an incoming call's phone number and associated metadata with no permission check, so a local app reads it with zero grants and no user…
- [Notification-Action / Trampoline Authorization Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_action_authorization_bypass/): A notification action fires a PendingIntent (or, on Android, trampolines through an exported receiver -> activity) that performs a privileged operation -…
- [Notification Listener Authorization Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_listener_authorization_bypass/): Notification-listener access is effectively granted without a proper user grant - above the lock screen, or via an unverified NotificationListenerService…
- [Ordered-Broadcast Result Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/ordered_broadcast_result_injection/): The app sends an ordered broadcast and then TRUSTS the aggregated getResultData() / result-extras, but a co-resident receiver registered at a higher priority…
- [Overlay Phishing](https://cpeoples.github.io/dvma/vulnerabilities/detail/overlay_phishing/): A credential screen can be covered by a look-alike overlay to phish input (no overlay/obscured-touch protection).
- [Platform-Version Security Fallback](https://cpeoples.github.io/dvma/vulnerabilities/detail/platform_version_security_fallback/): A security decision is gated on the OS version (if (SDK_INT >= X) / @available) and silently falls back to an INSECURE path on older versions - e.g. skipping…
- [QR Code Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_code_injection/): Scanner trusts scanned content and acts on it without validation.
- [SSRF via URL / Media Handler](https://cpeoples.github.io/dvma/vulnerabilities/detail/ssrf_url_media_handler/): An attacker-controlled URL parameter passed into a fetch/media loader is not restricted to an allowlist, so the app can be steered to internal/loopback…
- [Tapjacking](https://cpeoples.github.io/dvma/vulnerabilities/detail/tapjacking/): Sensitive action screen does not set filterTouchesWhenObscured.
- [AccessibilityService Privilege Abuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/accessibility_service_privilege_abuse/): An AccessibilityService performs a privileged action (launching an activity from the background, hiding/suppressing UI, injecting a gesture/click) with…
- [Activity Task-Stack / Affinity Hijacking](https://cpeoples.github.io/dvma/vulnerabilities/detail/activity_task_stack_hijacking/): Loose task affinity / launch modes (singleTask + shared taskAffinity, allowTaskReparenting) let a malicious Activity insert itself into a trusted app's…
- [Android Capability-Composition Chain](https://cpeoples.github.io/dvma/vulnerabilities/detail/android_capability_composition_chain/): No single hop is the bug - the COMPOSITION is. A notification action carries a mutable PendingIntent -> it fires an exported BroadcastReceiver -> the receiver…
- [App Intent / Siri Parameter -> Privileged Action (No Authz)](https://cpeoples.github.io/dvma/vulnerabilities/detail/app_intent_parameter_authorization/): An App Intent / Siri / Shortcuts / Spotlight entry point maps an untrusted, system-supplied parameter straight to a privileged app action (transfer, delete…
- [Authorization Based on Mutable Resource State](https://cpeoples.github.io/dvma/vulnerabilities/detail/authorization_by_mutable_resource_state/): A security/authorization decision is made on mutable resource existence or state (e.g. doesFileExist() -> grant access -> the file is then created/changed), so…
- [Clipboard -> Privileged Action Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_to_privileged_action_injection/): Clipboard content sourced from an untrusted origin flows into a privileged action (auto-paste into a payment/command field, an assistant/automation step) with…
- [Confused-Deputy Intent Validation Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/confused_deputy_intent_validation/): A privileged component performs an action on behalf of a caller after only a superficial Intent check, letting a local app abuse the app's privileges (Android…
- [Blind SQLi Boolean-Oracle Extraction (Contacts-Provider class)](https://cpeoples.github.io/dvma/vulnerabilities/detail/contacts_provider_blind_sqli_oracle/): A provider accepts a crafted WHERE/selection clause on a legacy code path with no strict-SQL hardening, so a permission-less caller uses a balanced subquery as…
- [Content Provider SQL Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/content_provider_sql_injection/): Exported content provider builds SQL by string concatenation.
- [content:// URI -> ContentResolver Confused Deputy](https://cpeoples.github.io/dvma/vulnerabilities/detail/content_uri_resolver_confused_deputy/): The app takes an attacker-supplied content:// URI (e.g. from an intent extra) and reads it through its OWN ContentResolver, so it becomes a proxy for a…
- [Cross-App Scripting (Untrusted Intent -> Exported Activity -> WebView JS)](https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_scripting/): An exported activity takes an attacker-controlled Intent value and passes it to WebView loadUrl()/evaluateJavascript() without validation, giving JS execution…
- [Cross-Profile (Work/Personal) Data & Capability Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_profile_data_capability_leakage/): Managed (work) and primary (personal) profiles are a security boundary, but the app crosses it unsafely - forwarded intents, URI grants, shared files…
- [Dynamic Code Loading (Arbitrary Code Execution)](https://cpeoples.github.io/dvma/vulnerabilities/detail/dynamic_code_loading_rce/): Loads and executes a dex/module/plugin from an untrusted third-party app or external storage with no verification.
- [File-Descriptor Capability Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/file_descriptor_capability_leakage/): The app passes an open ParcelFileDescriptor (via Binder, openFile(), or detachFd()) to an untrusted caller for a file/socket the caller could not otherwise…
- [FileProvider Path Traversal / Arbitrary File Sharing](https://cpeoples.github.io/dvma/vulnerabilities/detail/fileprovider_path_traversal/): An over-broad FileProvider / grantUriPermissions lets another app read arbitrary app-private files via a traversal path.
- [URI Permission / GRANT_URI_PERMISSIONS Abuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/grant_uri_permission_abuse/): A forwarded/redirected Intent carries FLAG_GRANT_READ/WRITE_URI_PERMISSION to a private content:// URI, so a malicious app is transitively granted access to…
- [Insecure WebView (JS Bridge RCE, file:// access)](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_webview/): WebView exposes a JS bridge and enables file:// access for RCE-style abuse.
- [Intent Argument Injection -> Local Code Execution](https://cpeoples.github.io/dvma/vulnerabilities/detail/intent_arg_injection_rce/): An exported component feeds an attacker-controlled intent extra / command-line arg into an execution path, so another app runs code with this app's privileges…
- [Intent Redirection / Task Hijack (StrandHogg-style)](https://cpeoples.github.io/dvma/vulnerabilities/detail/intent_redirection/): An exported component forwards an attacker-supplied nested intent to an internal component (intent redirection), and lax task affinity enables task hijack.
- [iOS Capability-Composition Chain](https://cpeoples.github.io/dvma/vulnerabilities/detail/ios_capability_composition_chain/): The vulnerability is the CHAIN, not any one API. A Universal Link resolves to an App Intent -> perform() reads its parameter as a security-scoped file…
- [Pending Intent Hijacking](https://cpeoples.github.io/dvma/vulnerabilities/detail/pending_intent_hijacking/): Mutable, implicit PendingIntent can be intercepted/redirected.
- [PendingIntent Provenance Confusion](https://cpeoples.github.io/dvma/vulnerabilities/detail/pendingintent_provenance_confusion/): An SDK/receiver assumes 'who presents a PendingIntent' == 'who created it', so a replayed/forwarded PendingIntent authenticates an attacker as the creating app…
- [Persistent URI-Grant Capability Abuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/persistable_uri_grant_abuse/): An exported component receives an attacker-controlled content:// URI carrying FLAG_GRANT_PERSISTABLE_URI_PERMISSION and calls takePersistableUriPermission()…
- [Privileged Service Binding / Binder Interface Exposure](https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_service_binding_exposure/): An exported/bindable Service exposes a privileged Binder interface (AIDL/Messenger) that any app can bindService() to and call without a caller-identity /…
- [Proximity Transfer Unsafe Parsing (AirDrop / Quick Share)](https://cpeoples.github.io/dvma/vulnerabilities/detail/proximity_transfer_unsafe_parsing/): The app parses an untrusted, pre-authentication proximity-transfer payload (AirDrop / Quick Share plist / XML / archive) with a naive, unbounded parser, so a…
- [App-Widget / RemoteViews Action Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/remoteviews_widget_action_injection/): An app-widget builds RemoteViews whose click/action PendingIntent is derived from attacker-influenceable widget-configuration state (config-activity extras…
- [Shortcuts / App Intents Path + Symlink Sandbox Escape](https://cpeoples.github.io/dvma/vulnerabilities/detail/shortcuts_path_symlink_sandbox_escape/): Untrusted Shortcuts / App Intents input drives a file operation whose path is resolved through a symlink or a ../ traversal with no canonicalization, so the…
- [System-Surface -> Privileged App Intent Exposure](https://cpeoples.github.io/dvma/vulnerabilities/detail/system_surface_privileged_appintent_exposure/): An App Intent surfaced to many system entry points (Siri, Spotlight, Shortcuts, Widget, Control, Live Activity, Action Button, Apple Intelligence) reaches a…
- [Telephony / Phone-Account Capability Abuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/telephony_capability_abuse/): A loosely-guarded / exported flow lets an untrusted caller drive a telephony capability - place a call, send an SMS, register or manipulate a phone account…
- [Unauthenticated Local / Loopback Service](https://cpeoples.github.io/dvma/vulnerabilities/detail/unauthenticated_local_loopback_service/): The app opens a local HTTP/TCP or unix-domain socket (for IPC, a debug bridge, a companion SDK, or a WebView bridge) with no authentication, so any co-resident…
- [Universal Link / AASA Associated-Domain Confusion](https://cpeoples.github.io/dvma/vulnerabilities/detail/universal_link_aasa_confusion/): The app trusts an incoming Universal Link because it matched an associated domain, but weak AASA deployment (overly broad path patterns / wildcards, open…
- [WebView Untrusted URL -> Local File Read (iOS WKWebView)](https://cpeoples.github.io/dvma/vulnerabilities/detail/wkwebview_untrusted_url_local_file/): Unsanitized user-controlled fields are reflected into a WebView, and file access is left enabled, so injected JS can read the app's local files from the…
- [Zero-Click Media Parse Before User Accept (VoIP-ring class)](https://cpeoples.github.io/dvma/vulnerabilities/detail/zero_click_call_media_parse_sink/): Attacker-controlled call-setup media is parsed while the call is still ringing, before the user accepts, so a declared-length lie drives an out-of-bounds read…
- [Zip Path Traversal (Zip-Slip)](https://cpeoples.github.io/dvma/vulnerabilities/detail/zip_path_traversal/): Update-package unpacker writes entries outside the target dir.

## Code Quality & Build Config

- [Debuggable Release Build](https://cpeoples.github.io/dvma/vulnerabilities/detail/debuggable_release_build/): Release build ships with debuggable=true / debug flags left on.
- [No Obfuscation / Symbol Stripping](https://cpeoples.github.io/dvma/vulnerabilities/detail/no_obfuscation/): Ships with readable symbols; no ProGuard/R8/Dart obfuscation.
- [Verbose Error Handling (leaked stack traces)](https://cpeoples.github.io/dvma/vulnerabilities/detail/verbose_error_handling/): Error screens render full stack traces and internal details.
- [Vulnerable Dependencies (known CVE)](https://cpeoples.github.io/dvma/vulnerabilities/detail/vulnerable_dependencies/): Bundles a library version with a documented known CVE.
- [Native Code Memory Bugs (JNI buffer overflow)](https://cpeoples.github.io/dvma/vulnerabilities/detail/native_code_memory_bugs/): A small JNI/FFI routine with a classic unbounded copy (optional/high-effort).

## Insufficient Resilience

- [App Attestation Not Implemented (server never verifies client)](https://cpeoples.github.io/dvma/vulnerabilities/detail/app_attestation_absent/): The backend accepts requests without an app-attestation token proving they come from a genuine, unmodified build, so a repackaged or scripted client is…
- [Device Attestation Not Implemented (Play Integrity / App Attest)](https://cpeoples.github.io/dvma/vulnerabilities/detail/device_attestation_absent/): The app trusts the client environment without requesting a hardware-backed device-integrity verdict (Play Integrity on Android, DeviceCheck/App Attest on iOS)…
- [Emulator Detection Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/emulator_detection_bypass/): Emulator check reads easily-spoofed build properties.
- [Malware / Overlay Co-Resident Detection Not Implemented](https://cpeoples.github.io/dvma/vulnerabilities/detail/malware_detection_absent/): The app never checks its runtime environment for known-malicious co-resident apps (accessibility abusers, overlay/tapjacking packages, known trojan package…
- [Root/Jailbreak Detection Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/root_jailbreak_detection_bypass/): Detection result gates on a client-side boolean easily hooked to false.
- [App Virtualization / Cloning Detection Not Implemented](https://cpeoples.github.io/dvma/vulnerabilities/detail/virtualization_detection_absent/): The app never detects that it is running inside an app-virtualization / cloning container (VirtualApp-style host, dual-app/work-profile clone), where a…
- [Anti-Debugging Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/anti_debugging_bypass/): Debugger check is a single function trivially patched out.
- [Anti-Tampering / Integrity Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/anti_tampering_integrity_bypass/): Integrity check never verifies anything meaningful (always passes).
- [Frida Detection Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/frida_detection_bypass/): Frida detection greps for a fixed string easily disabled.
- [TOCTOU Race Condition in Auth Check](https://cpeoples.github.io/dvma/vulnerabilities/detail/toctou_race_condition/): Auth is checked then used with a mutable gap an attacker can win.

## Supply Chain (OWASP Mobile M2)

- [Missing / Stale SBOM (No Component Inventory)](https://cpeoples.github.io/dvma/vulnerabilities/detail/sbom_missing_or_stale/): No Software Bill of Materials is produced, so bundled SDKs and their known-vulnerable versions are invisible to defenders.
- [Typosquatted Dependency](https://cpeoples.github.io/dvma/vulnerabilities/detail/typosquatted_dependency/): Depends on a lookalike package name mimicking a trusted one.
- [Insecure Firebase / Cloud Backend Config](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_firebase_cloud_config/): A world-readable Firebase/cloud backend URL plus hardcoded cloud credentials expose backend data.
- [Malicious Third-Party SDK](https://cpeoples.github.io/dvma/vulnerabilities/detail/malicious_third_party_sdk/): A bundled SDK exfiltrates data far beyond its stated purpose.
- [Unsigned / Unverified Build Artifact](https://cpeoples.github.io/dvma/vulnerabilities/detail/unsigned_unverified_build_artifact/): Update artifact fetched and applied with no signature/checksum check.
- [Dependency Confusion / Substitution](https://cpeoples.github.io/dvma/vulnerabilities/detail/dependency_confusion/): An internal/private package name is resolved from a public registry, so an attacker who publishes that name to the public index gets their impostor pulled into…
- [Bundled SDK Ships a Vulnerable Exported Component](https://cpeoples.github.io/dvma/vulnerabilities/detail/sdk_exported_component_redirection/): A bundled third-party SDK ships its own vulnerable exported component that intent-redirects, so another app abuses the SDK (not the host app's code) to reach…
- [Silent SDK Auto-Update (Post-Deploy Behavior Change)](https://cpeoples.github.io/dvma/vulnerabilities/detail/silent_sdk_auto_update/): A benign-looking SDK silently fetches and swaps in new behavior at runtime (SpinOK-style), turning malicious after install with no app update or review.

## Privacy (OWASP Mobile M6)

- [Installed-App Enumeration (Privacy Fingerprint)](https://cpeoples.github.io/dvma/vulnerabilities/detail/installed_app_enumeration/): The app probes which OTHER apps are installed - iOS canOpenURL over a scheme list, Android queryIntentActivities / getInstalledPackages - with no functional…
- [Missing Consent Before Data Access](https://cpeoples.github.io/dvma/vulnerabilities/detail/missing_consent_before_data_access/): Accesses location/contacts/photos with no consent screen.
- [No Tracking Transparency Prompt](https://cpeoples.github.io/dvma/vulnerabilities/detail/no_tracking_transparency_prompt/): Cross-app tracking begins with no ATT-equivalent prompt.
- [System Assistant -> Locked-Device Capability Abuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/assistant_locked_device_capability_abuse/): The system assistant surface (Siri / App-Intents / voice shortcuts) exposes sensitive information or performs a privileged capability while the device is…
- [Cross-App Browser History Access](https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_browser_history_access/): The app reads browsing history that belongs to another app / the system browser (a shared or world-readable history store) with no user consent, exposing the…
- [Lock-State Confusion Data Exposure](https://cpeoples.github.io/dvma/vulnerabilities/detail/lock_state_confusion_data_exposure/): Sensitive data or a privileged action is reachable while the device is LOCKED through an accessibility / notification / widget / VoiceOver path that never…
- [Notification Content Disclosure via Alternate Surface](https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_alternate_surface_disclosure/): Sensitive notification content that is redacted on the lock screen is rendered in full on a secondary presentation surface (desktop / DeX mode, widget…
- [PII in Analytics Events](https://cpeoples.github.io/dvma/vulnerabilities/detail/pii_in_analytics_events/): Raw PII (email, precise location) sent unfiltered in analytics events.
- [Privacy Control Alternate-Path Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/privacy_control_alternate_path_bypass/): App functionality reaches protected data through an ALTERNATE path that sidesteps the platform privacy control (a different API, a shared container / app…

## Input Validation (OWASP Mobile M4)

- [Deep Link Regex DoS (ReDoS)](https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_regex_dos/): A catastrophically-backtracking regex parses incoming deep-link URLs, so a crafted link freezes/hangs the app (Mattermost CVE-2024-3872 class).
- [Unsafe Media / Image Decoding](https://cpeoples.github.io/dvma/vulnerabilities/detail/unsafe_media_decoding/): Untrusted image/media bytes are passed straight to a decoder with no type/size/dimension checks, enabling decompression bombs and codec exploitation (Samsung…
- [Unvalidated Intent Extras](https://cpeoples.github.io/dvma/vulnerabilities/detail/unvalidated_intent_extras/): Intent extras trusted as-is, enabling privilege escalation.
- [Protected-Data Access via Input-Validation Confusion](https://cpeoples.github.io/dvma/vulnerabilities/detail/protected_data_access_via_input_validation/): Untrusted app-supplied input flows through a security-sensitive parser/normalizer whose result is then used to authorize access to a protected resource, so an…
- [Unsafe Deserialization](https://cpeoples.github.io/dvma/vulnerabilities/detail/unsafe_deserialization/): Deserializes untrusted data into typed objects with no validation.

## AI/ML (OWASP LLM/GenAI Top 10)

- [Hardcoded LLM API Keys](https://cpeoples.github.io/dvma/vulnerabilities/detail/hardcoded_llm_api_keys/): A cloud-LLM API key is shipped in the binary.
- [Direct Prompt Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/prompt_injection_direct/): User input can override the assistant's system instructions.
- [System Prompt Leakage](https://cpeoples.github.io/dvma/vulnerabilities/detail/system_prompt_leakage/): System prompt (with a fake secret) is extractable via the chat.
- [Unbounded AI Resource Consumption](https://cpeoples.github.io/dvma/vulnerabilities/detail/unbounded_ai_resource_consumption/): No rate limiting on AI calls enables a cost-exhaustion attack.
- [Excessive Agent Agency](https://cpeoples.github.io/dvma/vulnerabilities/detail/excessive_agent_agency/): Assistant has tool-calling (e.g. send message) with no confirmation.
- [Hidden Context Exposure](https://cpeoples.github.io/dvma/vulnerabilities/detail/hidden_context_exposure/): Untrusted retrieved/tool context that should have stayed out of reach (secrets, other users' data) is exposed to the model and the user (successor to…
- [Insecure On-Device Model Storage](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_ondevice_model_storage/): On-device model file is unsigned/unencrypted and swappable.
- [Insecure Output Handling](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_output_handling/): LLM output rendered unsanitized into a WebView / run as a query.
- [On-Device Model Extraction / Theft](https://cpeoples.github.io/dvma/vulnerabilities/detail/ondevice_model_extraction/): On-device model weights are readable/extractable from app storage, enabling model theft and offline attack crafting.
- [Indirect Prompt Injection (scanned QR/image/file)](https://cpeoples.github.io/dvma/vulnerabilities/detail/prompt_injection_indirect/): Hidden instructions in scanned QR/image/shared file are executed by the LLM.
- [Invisible / Unicode Prompt Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/unicode_invisible_prompt_injection/): Hidden instructions encoded with zero-width / RTL-override characters in scanned or shared text are obeyed by the assistant.
- [Unverified Model Supply Chain](https://cpeoples.github.io/dvma/vulnerabilities/detail/unverified_model_supply_chain/): Model update fetched from an unauthenticated URL with no checksum.
- [RAG Vector Store Poisoning](https://cpeoples.github.io/dvma/vulnerabilities/detail/rag_vector_store_poisoning/): A poisoned entry written to the on-device RAG/vector store is retrieved and trusted on later, unrelated queries.

## Agentic AI (OWASP Agentic Top 10)

- [Agent Tool Misuse / Confused Deputy](https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_tool_confused_deputy/): The agent reuses the app's own permissions/credentials to perform an unauthorized action on behalf of untrusted input (confused deputy).
- [Agent Memory & Context Poisoning](https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_memory_poisoning/): A malicious instruction is written to the agent's persistent memory and re-fires across future sessions after the context resets (MINJA-style).
- [Agent Task-Recovery Loop Weaponization](https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_recovery_loop_weaponization/): The agent's own error/task-recovery logic ('if stuck, tap back and retry') is steered by attacker-planted on-screen hints into a programmable multi-step…
- [Agent External-State TOCTOU Swap](https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_state_toctou_swap/): The agent validates an external resource (a config file / API response) and then reads it again at use time; a swap between check and use makes it act on…
- [GUI Agent Action Rebinding (Observation-Action Gap)](https://cpeoples.github.io/dvma/vulnerabilities/detail/gui_agent_action_rebinding/): A GUI agent plans a tap against the screen it observed, but a zero-permission app swaps the foreground to a sensitive target during the reasoning latency, so…
- [Insecure Inter-Agent Communication](https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_inter_agent_comms/): Messages between sub-agents are unauthenticated, so a spoofed message misdirects the agent cluster.
- [MCP Connector Capability Attestation Absent](https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_capability_attestation_absent/): A connected MCP server self-declares the capabilities (scopes) it holds, and the agent host grants them from the declaration alone with no attestation, so a…
- [MCP open_url -> Arbitrary Android Intent](https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_open_url_arbitrary_intent/): An MCP tool the agent can invoke (mobile_open_url) maps a model-supplied URL straight to Android startActivity() with no scheme allowlist, so a prompt-injected…
- [MCP / Tool Description Poisoning](https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_tool_poisoning/): A connected tool/MCP server's description carries hidden instructions that the agent ingests and obeys during planning.

## AI + Mobile (LLM x IPC / WebView)

- [AI Output Used as Intent / URL (navigation & redirection)](https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_to_intent_url/): The assistant's output is fed directly into startActivity()/url launcher, so a prompt-injected model can drive navigation, open redirects, or fire intents on…
- [Untrusted Mobile Input -> LLM Prompt (deep link / clipboard / QR)](https://cpeoples.github.io/dvma/vulnerabilities/detail/untrusted_mobile_input_to_llm/): Content arriving over a mobile trust boundary (deep-link param, clipboard, scanned QR, notification) is concatenated straight into the assistant's prompt…
- [Accessibility Tree -> Indirect Prompt Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/accessibility_tree_prompt_injection/): An on-device AI agent perceives the screen through the Android accessibility tree / visible UI text and feeds it into its prompt unfiltered, so untrusted…
- [AI Output -> Tool / Command Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_command_tool_injection/): The assistant maps model output to a tool/command invocation and executes it (with the app's privileges) before any validation, so attacker-influenced output…
- [AI Output Rendered in WebView (XSS / local-file read)](https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_to_webview_xss/): LLM output is injected into a WebView via loadHtmlString/evaluateJavascript with no encoding, so model-produced (attacker-influenced) HTML/JS executes in the…

## Native / WebView Bridge (JS <-> Native)

- [WebView Safe Browsing Disabled](https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_safe_browsing_disabled/): The WebView disables Google Safe Browsing (android:usesCleartextTraffic aside, EnableSafeBrowsing=false / setSafeBrowsingEnabled(false)), stripping the…
- [Embedded Mini-App Secret Exposure](https://cpeoples.github.io/dvma/vulnerabilities/detail/embedded_miniapp_secret_exposure/): An embedded web-app / Mini-App persists plaintext, replayable auth tokens (and recovery secrets such as wallet mnemonics) in WebView storage reachable over the…
- [Exported BroadcastReceiver Data Spoofing](https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_broadcast_receiver_spoof/): An exported BroadcastReceiver accepts broadcasts from any app and trusts their extras, so a local app spoofs data the app treats as authoritative (e.g. device…
- [QR / NFC Scan -> Privileged Action Without Confirmation](https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_nfc_to_privileged_action/): A scanned QR/NFC tag from an untrusted caller is forwarded straight to a privileged action / automation trigger with no user confirmation, so a co-resident app…
- [WebView Cleartext / Mixed-Content Transport Downgrade](https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_cleartext_mixed_content_downgrade/): A WebView opts out of cleartext blocking (android:usesCleartextTraffic / relaxed network-security-config) and relaxes the Mixed Content Policy…
- [WebView Remote Debugging Enabled](https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_remote_debugging_enabled/): WebView.setWebContentsDebuggingEnabled(true) is left on in a production build, so anyone with adb / chrome://inspect access can attach DevTools to the WebView…
- [Cross-Origin Iframe -> Native Bridge (No Main-Frame/Origin Check)](https://cpeoples.github.io/dvma/vulnerabilities/detail/crossorigin_iframe_to_native_bridge/): The JS-bridge message handler does not verify the message came from the main frame / trusted origin, so a cross-origin iframe reaches the bridge, runs JS in…
- [JS Bridge Callback-ID Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/js_bridge_callback_id_injection/): The native bridge trusts a caller-supplied callbackId and dispatches the result to it without validation, so web content forges an id to invoke a native…
- [JS Bridge Exposes a Privileged Native API](https://cpeoples.github.io/dvma/vulnerabilities/detail/js_bridge_exposes_privileged_api/): A bridge method exposes a privileged native capability (auth-token read, Keychain/Keystore, filesystem, camera/location) to any web content with no origin…
- [Provider-Controlled Metadata -> Plugin Filesystem Traversal](https://cpeoples.github.io/dvma/vulnerabilities/detail/provider_metadata_to_filesystem_traversal/): A framework/plugin layer (Flutter/React Native/Cordova/Capacitor) reads DISPLAY_NAME from an UNTRUSTED ContentProvider via ContentResolver.query() and uses it…
- [Shared WebView Mini-App Isolation Failure (Cross-Tenant Cookies)](https://cpeoples.github.io/dvma/vulnerabilities/detail/shared_webview_miniapp_isolation/): A super-app hosts multiple mini-programs in ONE shared WebView instance (shared cookie jar / localStorage), so one mini-app reads another mini-app's cookies…
- [WebView JS Injection + SSL-Validation Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_js_injection_ssl_bypass/): The WebView disables/relaxes TLS certificate validation (accept-all handler) while also permitting script injection, so a MITM attacker rewrites the loaded…
- [WebView Origin Confusion -> Local-Only IPC](https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_origin_confusion_ipc/): The WebView IPC layer classifies the caller's origin incorrectly, so a remote page is treated as the local/trusted application origin and can invoke…
- [WebView SOP / CSP Disabled (Cross-Origin & Inline Script)](https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_sop_csp_disabled/): The app's WebView relaxes/omits Same-Origin-Policy and Content-Security-Policy enforcement (e.g. allowUniversalAccessFromFileURLs /…
- [WebView URL-Loading Policy Confusion](https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_url_loading_policy_confusion/): The WebView's URL-policy handler (shouldOverrideUrlLoading / decidePolicyForNavigationAction) makes a trust decision on a raw, un-canonicalized URL, so…

## Privileged System-Provider Activation

- [App Group Shared-Container Privilege Amplification](https://cpeoples.github.io/dvma/vulnerabilities/detail/app_group_shared_container_amplification/): The app stores secrets (tokens, credentials, keys) in an App Group shared container / shared UserDefaults that every member of the group can read/write with no…
- [Assist / Screen-Context -> AI Action Exposure](https://cpeoples.github.io/dvma/vulnerabilities/detail/assist_screen_context_ai_exposure/): The app over-shares current-screen context through the Assist API (or fails to opt sensitive views out), so the system assistant / AI receives sensitive…
- [Companion Device Pairing / Capability Confusion](https://cpeoples.github.io/dvma/vulnerabilities/detail/companion_device_pairing_confusion/): An app pairs with a nearby companion device (watch / peripheral / car / IoT) via CompanionDeviceManager and then treats 'paired' as 'authorized for every…
- [Custom Keyboard / IME Input Interception](https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_keyboard_input_interception/): A custom keyboard / InputMethodService (or iOS keyboard extension) captures sensitive input typed in OTHER apps - passwords, OTPs, financial data, passkey/AI…
- [App Extension Activation != Input Authorization](https://cpeoples.github.io/dvma/vulnerabilities/detail/extension_activation_input_confusion/): An iOS app extension (Share / Action / File Provider / etc.) trusts the item it is handed simply because the system activated it - activation rules decide WHEN…
- [Lock-Screen Control / Widget Action Authorization](https://cpeoples.github.io/dvma/vulnerabilities/detail/lockscreen_control_action_authorization/): A Control Widget / interactive widget exposed on the Lock Screen, Control Center, or Action Button invokes a sensitive App Intent without the authentication…
- [Sensitive Notification -> Privileged AI Processing](https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_intelligence_ai_processing/): Sensitive notification content is fed to a privileged notification-intelligence / on-device AI consumer (summary, classification, smart-action) without…
- [Device Policy / MDM Capability Abuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/device_policy_mdm_capability_abuse/): A Device Admin / DevicePolicyManager receiver acts as a device-wide policy authority but validates policy parameters or caller/state insufficiently, so…
- [MediaProjection / Screen-Capture Authorization Bypass](https://cpeoples.github.io/dvma/vulnerabilities/detail/mediaprojection_screencapture_authorization_bypass/): An attacker-controlled value flows into MediaProjection / screen-capture authorization (a reused/forwarded projection token, a consent-result treated as…
- [Privileged Input-Provider (IME) Event Injection](https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_input_provider_injection/): The default input-method (IME) surface accepts key/motion events from an untrusted caller because a permission/caller check is missing, so a co-resident app…
- [Privileged Provider Activation Abuse](https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_provider_activation_abuse/): An app becomes an enabled system provider (accessibility / notification-listener / VPN / IME / device-admin / call-screening / phone-account / MediaProjection…
- [VPN Provider Trust-Anchor / Tunnel MITM](https://cpeoples.github.io/dvma/vulnerabilities/detail/vpn_provider_trust_anchor_abuse/): An app that provides a VPN tunnel authenticates the tunnel endpoint weakly - disabled/loose certificate validation, a custom trust manager, user-controllable…