Android

196 Android manual-verification steps, grouped by category. Each is a module that needs an external tool the in-app suite can’t drive.

Insecure Data Storage

• insecure_local_storage, pull shared_prefs/*.xml (Android) or the app’s NSUserDefaults plist (iOS) via adb/objection and confirm the token/SSN/card are cleartext.
• keychain_keystore_misuse, dump the Keychain with objection / keychain-dumper and confirm weak accessibility / no hardware backing.
• insecure_backups, run adb backup (or a Finder/iMazing backup) and confirm app data is recoverable from the backup.
• clipboard_leakage, copy a sensitive field, then read the clipboard from a second app / adb shell and confirm the secret is present.
• screenshot_taskswitcher_leakage, background the app on a sensitive screen and inspect the task-switcher snapshot.
• sensitive_data_in_logs, adb logcat / idevicesyslog while using the app; confirm PII/tokens are logged.
• keyboard_cache_autofill_leakage, type into a sensitive field, then inspect the IME’s personalized-dictionary / autofill cache and confirm the secret was retained (field not marked no-suggestions / no-autofill).
• temp_file_leftovers, browse the app cache/temp dirs and confirm sensitive leftovers.
• third_party_sdk_data_leakage, proxy traffic with mitmproxy and confirm the SDK exfiltrates more than its stated purpose.
• sensitive_data_in_memory, dump the process memory (fridump / objection / gdb) and recover the retained password/key.
• insecure_sdcard_external_storage, read the app’s file from shared / external storage with a second app or adb.
• backup_archive_integrity_tampering, pull a backup, flip a persisted flag (e.g. is_premium/is_admin) or a balance, re-pack, restore, and confirm the app trusts the tampered state; verify the secure build verifies a keyed MAC over the archive and rejects it (CVE-2025-49199, MASTG-BEST-0065).
• local_security_state_integrity_tampering, edit a UserDefaults / SharedPreferences / SQLite value that gates a security decision (role / entitlement) and confirm the app trusts it; verify the secure build binds the value to a keyed MAC / server authority and rejects the edit.
• auth_state_rollback_restore, restore a stale session/token blob (old backup/snapshot) and confirm the app revives the ended/revoked session; verify the secure build validates freshness/revocation server-side and rejects the rolled-back state.
• sensitive_data_in_crash_reports, trigger a crash and confirm the crash payload shipped to the crash service contains secrets/PII/request bodies; verify the secure build scrubs/allowlists the crash payload before sending.

Insufficient Cryptography

• weak_algorithms, strings/jadx the binary and confirm a broken primitive (DES/RC4/MD5/SHA-1/ECB) is used; capture ciphertext and show the structural weakness (e.g. ECB pattern leakage).
• hardcoded_keys_ivs, strings/jadx the binary and recover the key/IV.
• insecure_random, sample the “random” token/nonce/OTP repeatedly and confirm it is predictable (java.util.Random / non-CSPRNG seed).
• weak_key_derivation, capture the derived material and crack with hashcat given the low/absent iteration count.
• custom_crypto_implementation, reverse the hand-rolled cipher with jadx/Ghidra and confirm it is trivially reversible (XOR / rolled AES) vs a platform primitive.
• improper_mac_verification, flip a byte in an authenticated payload and confirm it is accepted (no constant-time MAC compare / MAC not checked).
• improper_signature_verification, tamper a signed blob/update and confirm it is accepted (signature skipped or wrong key/no chain check).
• device_secure_lock_not_enforced, run the app on a device with no screen lock and confirm sensitive features/keys are still available (no setUserAuthenticationRequired / secure-lock gate).
• unauthenticated_encryption_malleable_ciphertext, bit-flip AES-CBC ciphertext (no MAC) and confirm the corresponding plaintext bit flips on decrypt (malleable / no integrity).
• rsa_no_oaep_padding, confirm RSA uses PKCS#1 v1.5 (not OAEP) and demonstrate the padding-oracle distinguisher against the decrypt endpoint.

Insecure Authentication / Authorization

• weak_session_management, capture the session token and confirm it is predictable / never rotated on privilege change / never expires (replay it after logout).
• insecure_biometric_prompt, hook the auth callback with Frida and force the success path.
• weak_password_policy, register/change password to a trivial value (123456, password) and confirm it is accepted (no length/complexity/breach check).
• client_side_only_authorization, flip the client-side admin flag with Frida/objection and confirm privileged actions unlock.
• jwt_vulnerabilities, forge an alg:none token / crack the weak secret with jwt_tool and confirm acceptance.
• oauth_misconfiguration, capture the implicit-flow token from the redirect/logs under mitmproxy.
• passkey_weak_attestation, register with none attestation via a WebAuthn test harness and confirm acceptance.
• passkey_origin_binding_bypass, assert from an origin that merely contains the rpId and confirm acceptance.
• passkey_credential_exfiltration, pull the credential store off-device and confirm private-key material is present.
• passkey_fallback_downgrade, force “passkey unavailable” and confirm the weak fallback path is accepted.
• passkey_assertion_replay_signcount, capture a WebAuthn assertion and replay it; confirm it is accepted again because the sign-count/credential counter is never compared (Craft CMS CVE-2026-72780 class).
• passkey_challenge_reuse, record an assertion for the server’s challenge and replay it; confirm the static/reused challenge accepts it.
• passkey_user_verification_bypass, submit an assertion with the UV flag unset under a userVerification=REQUIRED policy and confirm it is accepted (Spring Security CVE-2026-47841 class).
• passkey_stepup_auth_bypass, trigger a sensitive action and confirm step-up is marked “verified” from a registered passkey without completing an assertion (New-API AI gateway CVE-2026-32879 class).
• passkey_credential_management_authz, call the register/delete passkey endpoint as a different user and confirm you can add your own passkey or delete the victim’s (account takeover / lockout; USENIX 2026 class).
• passkey_session_fixation, set a known pre-auth session id, complete a passkey assertion, and confirm the id is not rotated afterwards.
• passkey_thirdparty_pairing_authz, approve a third-party authenticator / cross-device pairing and confirm no permission check gates it (Android CVE-2025-48640 / BLE CVE-2026-65935 class).
• insecure_credential_manager, confirm a credential is associated with an unverified domain (no Digital Asset Links / AASA) and autofills into an insecure field.
• username_enumeration, compare login responses for valid vs invalid usernames and confirm they differ.
• insecure_password_reset_token, request multiple reset tokens/magic links and confirm they are short, related/predictable, and never expire.
• developer_backdoor, decompile with jadx / strings and recover the hardcoded backdoor credential or debug route.
• cross_app_otp_credential_leak, from a second (unprivileged) app, read the OTP / myauth:// auth deep link this app publishes on an unprotected exported component/broadcast/clipboard (Authenticator CVE-2026-26123 class); confirm an allowlisted/signature-checked channel yields nothing.
• deeplink_authentication_bypass, fire a deep link (e.g. dvma://wallet) via adb while logged out and confirm it reaches the authenticated screen without the app-lock/login gate (Groww CVE-2026-12065 class).
• biometric_authorization_not_bound, capture a biometric success for operation A and replay it to authorize operation B (the boolean isn’t tied to the operation), and overlay the prompt; verify the secure build binds the result to a per-operation signed challenge (CryptoObject) so it only authorizes the exact op (Android biometric-overlay CVE-2025-48528 class).
• credential_provider_release_authorization, from a spoofed calling app / with an rpId mismatch (and no user-verification) extract a stored credential/passkey and enumerate entries; verify the secure build binds the calling app to the rpId, requires UV, and refuses enumeration (credential- provider release-boundary class).
• multi_account_isolation_failure, log into account A, switch to / log into account B, and confirm A’s cached token/data is still readable (and A’s session survives logout); verify the secure build scopes per-account state to the active principal and wipes/rotates it on switch and logout.
• identity_credential_presentation_binding, replay a captured mDL/mDoc (Identity Credential / ISO 18013-5) or Wallet identity presentation from a different session and confirm the verifier accepts it on issuer signature alone; verify the secure build binds the device signature to this session’s transcript + reader nonce and requires fresh user presence.

Insecure Communication

• cleartext_traffic_allowed, confirm plain HTTP under mitmproxy.
• weak_tls_config, run testssl.sh against the endpoint.
• ssl_pinning_bypass, bypass pinning with objection/Frida and MITM.
• accept_all_trust_manager, confirm any cert is accepted under MITM.
• insecure_webview_networking, confirm mixed/cleartext content loads.

Improper Platform Usage

• insecure_webview, reach the JS bridge / file:// and demonstrate RCE-style behavior.
• deeplink_url_scheme_hijack, fire crafted deep links with adb.
• exported_android_components, enumerate/invoke with drozer.
• content_provider_sql_injection, inject via the provider with drozer.
• pending_intent_hijacking, intercept the mutable PendingIntent.
• tapjacking, overlay a PoC app and confirm the tap passes through.
• over_privileged_permissions, review the manifest with aapt/jadx.
• push_notification_leakage, inspect notification payloads / lockscreen.
• qr_code_injection, scan a crafted QR and confirm unvalidated action.
• zip_path_traversal, feed a zip-slip archive to the update unpacker.
• missing_flag_secure, adb shell screenrecord a sensitive screen.
• intent_redirection, send crafted extras carrying a nested intent via drozer/adb and confirm it is forwarded to an internal component.
• predictive_back_leakage, trigger the Android 14+ predictive-back / recents snapshot on a sensitive screen and confirm it is captured.
• photo_picker_over_access, review the manifest/Info.plist and confirm full media-library access is requested instead of the scoped photo picker.
• fileprovider_path_traversal, via drozer / a companion app, request a traversal path (../) through the FileProvider and read an app-private file.
• dynamic_code_loading_rce, supply a malicious module/dex from a companion app or external storage and confirm it executes unverified.
• overlay_phishing, draw an overlay over the credential screen with a PoC app and confirm input can be captured / the tap is obscured.
• intent_arg_injection_rce, with drozer/adb, invoke the exported component with a crafted extra (e.g. -xrun/cmd/loadLibrary) and confirm attacker-controlled args reach an execution path with the app’s privileges (Unity CVE-2025-59489 class); confirm the allowlist handler rejects it.
• deeplink_to_webview_navigation, send a deep link whose url param points off-origin (or javascript:/file://) and confirm it loads in the trusted WebView with no origin allowlist (TikTok CVE-2024-45240 / Rakuten CVE-2024-41918 / EcoOnline CVE-2026-26897 class).
• exported_component_arbitrary_url_activity, via drozer/adb, deliver an external intent naming an attacker URL / internal activity and confirm it opens with the app’s identity (ABEMA CVE-2024-28745 / Samsung Members CVE-2026-20985 & CVE-2025-21079 class).
• implicit_intent_sensitive_data, register a receiver in a second app for the same action and confirm sensitive extras sent on an implicit intent are delivered to it (Samsung Smart View CVE-2025-21024 class); confirm an explicit (packaged) send does not leak.
• pendingintent_provenance_confusion, obtain/replay a PendingIntent the app created and confirm the receiving SDK authenticates the presenter as the creator app (arXiv 2603.02539); confirm strict presenter==creator checking rejects it.
• inapp_browser_ui_spoofing, load attacker content that sets a fake title/origin and confirm the in-app browser address bar shows a trusted origin while the real committed URL is the attacker’s (Firefox Focus CVE-2025-10290 / LINE CVE-2024-5739 class).
• cross_app_scripting, from a co-resident app, fire an Intent whose value is a javascript: payload (or an attacker URL) at the exported activity and confirm it executes in the WebView’s trusted origin; verify the secure build validates scheme+origin first (Google Cross-App Scripting class; Element CVE-2024-26131/26132, TikTok CVE-2024-45240).
• grant_uri_permission_abuse, send a redirected Intent carrying FLAG_GRANT_READ_URI_PERMISSION to a private content:// URI and confirm the malicious app reads a file it was never granted directly (Pixel CVE-2024-27222 class).
• custom_url_scheme_authorization, adb shell am start/xcrun simctl openurl a dvma://open?url=https://attacker.example and confirm the app loads the attacker site with no caller/allowlist check (Rakuten CVE-2024-41918 / @cosme CVE-2024-45203 / Groww CVE-2026-12065 class).
• confused_deputy_intent_validation, from an unprivileged app, invoke the privileged component with a superficially-valid Intent and confirm the action runs with the app’s privileges (Android Settings CVE-2025-32326 / CVE-2025-32321 class).
• ssrf_url_media_handler, pass an internal/loopback/metadata URL (http://169.254.169.254/...) to the media/URL loader and confirm the app fetches it; verify the secure build allowlists public hosts only (WhatsApp iOS CVE-2026-23866 class).
• qr_url_no_validation, scan a QR encoding a javascript: or privileged dvma:// payload and confirm it is opened/navigated with no validation (Firefox iOS QR-scanner CVE-2025-54145 class).
• proximity_transfer_unsafe_parsing, feed a malformed plist / deeply nested XML entity-expansion bomb as a proximity-transfer (AirDrop/Quick Share) payload and confirm the naive parser blows up (huge expansion / state confusion) with no pairing; verify the secure build caps depth, entity expansion, and size and rejects it (AirDrop & Quick Share proximity-protocol research class).
• exported_component_state_manipulation, from a com.evil.* app, send the exported component an intent naming the victim’s notification id and confirm it is cancelled with no ownership check; verify the secure build requires owner==caller (or a signature permission) and refuses the cross-owner mutation (Datadog Android CVE-2026-47361 class).
• contentprovider_filename_path_traversal, import a file whose display name is ../../shared_prefs/secrets.xml and confirm it escapes the import dir and overwrites/reads an app file; verify the secure build canonicalizes and confines the path under the import root (Android ContentProvider import traversal CVE-2025-65814 / CVE-2025-65815 class).
• content_uri_resolver_confused_deputy, hand the app an attacker content://com.dvma.private/... URI in an intent extra and confirm it reads the privileged provider through its own ContentResolver and returns the data to you (confused deputy); verify the secure build validates the caller may access that authority and refuses the privileged read (Android DownloadProvider CVE-2025-26417 class).
• accessibility_service_privilege_abuse, from the a11y service trigger a background activity launch / UI-hide / injected gesture with no valid a11y event and confirm the privileged action fires; verify the secure build requires a user-enabled service, a genuine foreground event, and an action allowlist (Android AccessibilityServiceConnection CVE-2025-26462 / CVE-2023-21109 class).
• notification_listener_authorization_bypass, bind a notification listener with no recorded user grant (above lock / unverified filter) and read all notification contents; verify the secure build requires a persisted grant recorded while unlocked and a verified listener component (Android CVE-2025-22427 / CVE-2025-26442 class).
• background_activity_launch_abuse, from a background caller drive a component to startActivity() onto a security-sensitive/consent surface and confirm the phishing/task-hijack UI appears; verify the secure build enforces BAL (foreground or valid launch token) and refuses the launch (Android CVE-2025-26462 class).
• clipboard_unauthorized_write_integrity, from untrusted content (a page in the app WebView / another app) overwrite the system clipboard with no user gesture and confirm the user pastes attacker-controlled data (e.g. a swapped crypto address); verify the secure build requires a trusted origin + user gesture (Lenovo Android web-to-clipboard CVE-2026-7516 class).
• clipboard_to_privileged_action_injection, seed the clipboard from an untrusted origin and confirm it flows into a privileged action (auto-paste into a payment/command field / automation step) with no validation; verify the secure build validates/allowlists the value and requires explicit confirmation (webpage → clipboard → automation → privileged capability; CVE-2026-17766 class).
• authorization_by_mutable_resource_state, request access using a file-existence/state pre-check, then create/replace the resource and confirm you gain read/write to a file you shouldn’t own (incl. not-yet-existing files); verify the secure build binds authorization to a stable owner captured atomically (Android MediaProvider CVE-2026-0035 class).
• telephony_capability_abuse, from an untrusted/exported caller invoke a telephony capability (place a call to a premium number / send SMS / register a phone account) with no per-invocation permission check; verify the secure build requires the matching permission + per-invocation confirmation (Android Telecom CVE-2026-28615 class).
• cross_profile_data_capability_leakage, forward a work-profile credential to a personal surface (share sheet / clipboard / intent) and confirm it crosses; verify the secure build enforces a cross-profile policy (only allowlisted, non-sensitive items may cross, with the required user affordance) so work data is blocked (Android managed-profile leakage class).
• unauthenticated_local_loopback_service, hit the app’s loopback HTTP/TCP or unix-domain socket from a co-resident app or a DNS-rebinding web origin (no token) and confirm privileged data/functionality is served; verify the secure build requires a per-session token and validates the Origin/Host, rejecting rebinding + untokened callers.
• contacts_provider_blind_sqli_oracle, with drozer, send boolean/time-based selection clauses to the contacts-style provider and confirm a blind-SQLi oracle leaks rows the caller shouldn’t see.
• incoming_call_metadata_missing_authorization, from an unprivileged app read/observe incoming-call metadata (number/state) via the exported surface with no permission check and confirm it is disclosed.
• zero_click_call_media_parse_sink, deliver a crafted call/media payload that reaches the parser with no user interaction and confirm it is parsed unsafely (crash / state confusion) at the zero-click sink.
• dynamic_broadcast_receiver_exposure, from a co-resident app, send a crafted broadcast to a receiver registered at runtime without RECEIVER_NOT_EXPORTED / a signature permission and confirm the sensitive action fires; verify the secure build registers not-exported and drops it.
• privileged_service_binding_exposure, bindService() from an untrusted package and call a privileged Binder method with no caller check; verify the secure build validates caller identity / a signature permission before returning a usable binder.
• activity_task_stack_hijacking, launch a malicious Activity that spoofs the victim’s taskAffinity (StrandHogg-style) and confirm it appears atop the trusted task; verify the secure build uses a unique affinity and disallows reparenting so it lands in its own task.
• activity_alias_exposure, launch a protected Activity through an <activity-alias> that is exported=true / lacks the target permission; verify the secure alias echoes the target’s protection and refuses the external caller.
• platform_version_security_fallback, run on an OS below the feature threshold and confirm the if (SDK_INT >= X) guard silently drops to an insecure path (no hardware key backing); verify the secure gate fails closed on the unsupported OS.
• default_role_holder_confusion, register a co-resident app for the role intent-filter (browser/dialer/SMS/wallet), confirm the app delegates a secret to whatever resolveActivity() returns; verify the secure build checks the actual RoleManager holder and pins package + signature.
• persistable_uri_grant_abuse, send an exported component a content:// URI with FLAG_GRANT_PERSISTABLE_URI_PERMISSION, confirm it calls takePersistableUriPermission() and the grant survives revocation while the provider swaps data; verify the secure build never persists untrusted grants.
• clipdata_uri_grant_leakage, fire an implicit Intent whose ClipData carries a private content:// URI + FLAG_GRANT_READ_URI_PERMISSION and confirm a co-resident resolver can read the private data; verify the secure build sends explicit intents and never grants on untrusted-resolver ClipData.
• file_descriptor_capability_leakage, bind the service and receive a ParcelFileDescriptor for a sensitive DB the caller couldn’t open by path; verify the secure build validates the caller and only returns a read-only FD to a narrowly-scoped non-sensitive resource.
• ordered_broadcast_result_injection, register a higher-priority receiver that rewrites the result via setResultData() / abortBroadcast() and confirm the app trusts the poisoned result; verify the secure build guards the broadcast with a signature permission and never trusts ordered-broadcast results for security decisions.
• remoteviews_widget_action_injection, supply attacker widget-config extras that populate a RemoteViews action PendingIntent and confirm tapping the widget runs a privileged transfer with attacker params; verify the secure build binds only immutable explicit intents and re-auths destructive ops.
• notification_action_authorization_bypass, trigger a notification action (Android trampoline receiver→activity / iOS UNNotificationAction) that approves a transfer with no fresh auth; verify the secure build routes every surface through the same authorization check and re-auths destructive actions.
• custom_signature_permission_squatting, protect an IPC component with a normal-level custom permission (or define the permission name first from a malicious app) and confirm the guard is trivially held; verify the secure build uses signature protection and checks the caller’s signing identity.
• android_capability_composition_chain, trigger the notification action (or send the broadcast directly) as an untrusted caller and confirm the mutable PendingIntent → exported receiver → bound Binder service → transfer chain runs the transfer without ever re-checking the original caller; verify the secure build propagates + re-authorizes the original caller at the sink and uses immutable/explicit intents + per-method authorization.

Code Quality & Build Config

• debuggable_release_build, confirm debuggable=true in the release APK.
• no_obfuscation, confirm readable symbols with jadx/nm.
• verbose_error_handling, trigger an error path (bad input, forced failure) and confirm the response/UI/log leaks a stack trace, SQL, or internal path instead of a generic message.
• vulnerable_dependencies, run osv-scanner / dependency-check.
• native_code_memory_bugs, analyze the native lib in Ghidra; trigger the overflow.

Insufficient Resilience

• root_jailbreak_detection_bypass, bypass with objection/Frida.
• anti_debugging_bypass, patch out the debugger check.
• anti_tampering_integrity_bypass, modify the APK and confirm it runs.
• emulator_detection_bypass, spoof build props and bypass.
• frida_detection_bypass, disable the Frida string check.
• toctou_race_condition, win the check-to-use race.
• malware_detection_absent, install a known-bad/sideloaded companion and confirm the app performs no on-device threat check before handling secrets.
• device_attestation_absent, confirm the server accepts requests with no hardware key-attestation / DeviceCheck evidence, so a rooted/emulated device is trusted.
• app_attestation_absent, MITM the app’s API and confirm no app attestation (Play Integrity / App Attest) token is required, so a repackaged/emulated client is served normally.
• virtualization_detection_absent, run inside an app-cloner / work- profile / virtual space and confirm the app runs with no detection of the virtualized container.

Supply Chain (OWASP Mobile M2)

• malicious_third_party_sdk, confirm exfiltration under mitmproxy.
• typosquatted_dependency, review pubspec for the lookalike name.
• unsigned_unverified_build_artifact, verify with apksigner and confirm the update path skips signature/checksum checks.
• insecure_firebase_cloud_config, extract the Firebase/cloud URL + keys with jadx/strings and confirm an unauthenticated read returns other users’ data (curl / mitmproxy).
• sbom_missing_or_stale, confirm the build produces no Software Bill of Materials; generate one (e.g. CycloneDX) and cross-reference bundled SDK versions against advisories to reveal the components that were invisible.
• silent_sdk_auto_update, under mitmproxy, serve a modified remote “SDK behavior” payload and confirm it is applied at runtime with no signature/checksum check, changing app behavior post-install (SpinOK-style).
• dependency_confusion, confirm an internal/private package name can be resolved from a public registry (pubspec/CocoaPods/SPM), so a higher public version would be pulled over the trusted private one; confirm scoped/pinned resolution prevents it (iOS dependency-management research class).
• sdk_exported_component_redirection, with drozer/adb, deliver a nested “forward” intent to a bundled SDK’s exported component and confirm it redirects to a private component (leaking credentials) with the host app’s privileges (EngageLab SDK class); confirm the allowlisted handler refuses.

Privacy (OWASP Mobile M6)

• missing_consent_before_data_access, confirm data access with no consent screen.
• pii_in_analytics_events, capture analytics events under mitmproxy.
• installed_app_enumeration, confirm the app probes a broad scheme/package list (iOS canOpenURL / Android queryIntentActivities) and builds an installed-app fingerprint with no functional need; verify the secure build checks only its one declared scheme (iOS CVE-2026-20641 class).
• cross_app_browser_history_access, read browsing history belonging to another app / the system browser with no consent; verify the secure build requires explicit consent and scoping (iOS CVE-2026-20656 Safari-history class).
• notification_alternate_surface_disclosure, trigger a notification redacted on the lock screen and confirm its full content renders on a secondary surface (DeX/desktop mode, widget, companion display); verify the secure build applies the same redaction policy on every unauthenticated surface (Samsung DeX CVE-2026-21006 class).
• lock_state_confusion_data_exposure, while the device is LOCKED, reach sensitive content/action through an accessibility / notification / widget / VoiceOver path that never re-checks the keyguard; verify the secure build re-checks lock state and redacts (iOS CVE-2026-20645 / CVE-2026-20661 class).
• privacy_control_alternate_path_bypass, read protected data through an alternate path (a different API, a shared app-group container, a cached copy) that sidesteps the consent gate; verify the secure build funnels all reads through the single consent-checked accessor (iOS CVE-2026-20606 class).

Input Validation (OWASP Mobile M4)

• unsafe_deserialization, craft a malicious serialized payload.
• unvalidated_intent_extras, send crafted extras with drozer/adb.
• unsafe_media_decoding, feed a crafted image (spoofed huge dimensions / decompression bomb / unexpected format) and confirm the app decodes it with no size/type/dimension validation (Samsung CVE-2025-21043 class); confirm the safe decoder rejects it on caps + format allowlist.
• deeplink_regex_dos, send a crafted deep link that triggers catastrophic regex backtracking in link parsing and confirm the app freezes/hangs (Mattermost CVE-2024-3872 class); confirm the linear/anchored parser stays responsive.
• protected_data_access_via_input_validation, send an evasive identifier (encoded / .. / case / unicode variant such as users/./admin/%2E%2E/admin/SSN) that slips a protected id past a naive deny check and returns protected data; verify the secure build canonicalizes FIRST and checks the canonical form (Apple protected-data-via-input-sanitization CVE-2026-43714 class).

AI/ML (OWASP LLM/GenAI Top 10)

• prompt_injection_indirect, encode hidden instructions in a scanned QR/image/file and confirm the assistant obeys them.
• insecure_output_handling, confirm LLM output is rendered/executed unsanitized.
• excessive_agent_agency, confirm a tool call fires with no confirmation.
• hardcoded_llm_api_keys, strings/jadx the binary and recover the key.
• insecure_ondevice_model_storage, locate and swap the model file.
• unverified_model_supply_chain, MITM the model update and serve a tampered model with no checksum failure.
• unbounded_ai_resource_consumption, script rapid AI calls and confirm no rate limiting.
• rag_vector_store_poisoning, ingest a poisoned document, then run an unrelated query and confirm the poisoned entry is retrieved and obeyed.
• hidden_context_exposure, confirm private/other-tenant context is surfaced to the model/user (no context partitioning).
• ondevice_model_extraction, pull the on-device model file and confirm the weights are extractable (unencrypted/unsigned).
• unicode_invisible_prompt_injection, craft text with zero-width / RTL-override characters and confirm the assistant obeys the hidden instruction (input not sanitized).

Agentic AI (OWASP Agentic Top 10)

• agent_memory_poisoning, plant an instruction in the agent’s persistent memory and confirm it re-fires in a later session after reset.
• mcp_tool_poisoning, connect a tool/MCP server whose description carries hidden directives and confirm the agent obeys them during planning.
• agent_tool_confused_deputy, cause the agent to reuse the app’s ambient permission/credential for an unauthorized action with no re-auth.
• insecure_inter_agent_comms, spoof a message between sub-agents and confirm the receiver acts on the unauthenticated message.
• mcp_open_url_arbitrary_intent, via prompt injection, drive the agent’s mobile_open_url MCP tool to a dangerous scheme (tel:, sms:, content://, intent://) and confirm it is dispatched to startActivity() with no allowlist; verify the secure build allows only http/https and requires user confirmation (Mobile MCP CVE-2026-35394 class).

AI + Mobile (LLM x IPC / WebView)

• untrusted_mobile_input_to_llm, deliver a prompt-injection payload over a mobile trust boundary (deep-link param, clipboard, scanned QR, notification) and confirm it is concatenated into the assistant prompt and obeyed; verify the secure build treats it as quoted data (Monica CVE-2024-48142 class).
• ai_output_to_webview_xss, steer the model to emit HTML/JS, confirm it executes when rendered into the WebView unescaped, and that the secure build escapes/sanitizes it (FAQ-Bot CVE-2025-63639 / ZOLL ePCR CVE-2025-12699 class).
• ai_output_to_intent_url, steer the model to emit a URL/intent and confirm it is launched with no allowlist/confirmation; verify the secure build allowlists + confirms first.
• ai_output_command_tool_injection, steer the model to emit a tool/command call and confirm it executes with app privileges before any validation; verify the secure build uses an allowlisted tool registry with argument validation (Microsoft 365 Copilot iOS/Android CVE-2026-26133 class).
• accessibility_tree_prompt_injection, plant imperative text in an on-screen/a11y node (e.g. “IGNORE PREVIOUS INSTRUCTIONS…”) and confirm the agent, which builds its prompt from the accessibility tree, obeys it and takes an unauthorized action; verify the secure build treats UI/a11y text as quoted untrusted data and ignores it (Android Accessibility mobile-agent injection research).

Native / WebView Bridge (JS <-> Native)

• js_bridge_callback_id_injection, from web content, post a bridge message naming another plugin’s callbackId and confirm you receive that plugin’s native result (Camera/Contacts/Files/Geolocation); verify the secure build validates the callback id (regex + plugin ownership) and rejects it (Cordova InAppBrowser iOS CVE-2026-47430 class).
• crossorigin_iframe_to_native_bridge, deliver a bridge message from a cross-origin iframe and confirm the handler acts on it and returns the access/session token; verify the secure build requires isMainFrame and a trusted origin and blocks it (Home Assistant Companion CVE-2026-44698 class, Android addJavascriptInterface / iOS WKUserContentController).
• js_bridge_exposes_privileged_api, from an arbitrary loaded page, call a bridge method that returns an auth token / reads a file (or reaches camera/location) and confirm it succeeds with no gate; verify the secure build enforces an origin allowlist + capability check.
• qr_nfc_to_privileged_action, feed a QR/NFC payload from an untrusted caller and confirm the named automation/action fires with no user confirmation; verify the secure build requires a trusted source and an explicit confirmation (Home Assistant Companion GHSA NFC/QR class).
• exported_broadcast_receiver_spoof, send a broadcast from a com.evil.* package with spoofed extras (e.g. device location) and confirm the app treats it as authoritative; verify the secure build checks the sender package / signature-level permission (Home Assistant Companion GHSA location-spoof class).
• webview_origin_confusion_ipc, invoke a local-only privileged IPC command from a remote origin (e.g. https://tauri.localhost.evil.com) and confirm the loose origin classifier treats it as local and executes it; verify the secure build compares the canonical origin (scheme+host+port) exactly and rejects the remote page (Tauri WebView IPC origin confusion CVE-2026-42184 class).
• webview_js_injection_ssl_bypass, with the accept-all TLS handler, MITM the WebView load, inject <script>, and confirm a token is exfiltrated / a privileged action fires; verify the secure build validates the certificate so the forged/MITM content never loads (PayRange CVE-2026-13461 class).
• embedded_miniapp_secret_exposure, read the embedded Mini-App’s WebView storage over the JS↔native bridge and confirm a plaintext, replayable auth token (and a recovery secret such as a wallet mnemonic) is exposed to any origin; verify the secure build issues an origin-bound, single-use handle and never exposes the mnemonic (Telegram Mini App / TENET research class).
• webview_sop_csp_disabled, with universal file access on and no CSP, confirm a file:// page reads a cross-origin resource and runs inline script in the app origin (token read); verify the secure build disables universal access and enforces a restrictive CSP (WebKit SOP CVE-2026-20643 / CSP CVE-2026-20665 app-level analog).
• shared_webview_miniapp_isolation, from mini-app A, read mini-app B’s cookie/localStorage out of the shared WebView jar; verify the secure build partitions storage per mini-app origin so A cannot see B (WeChat/Alipay cross-mini-program cookie-sharing research class).
• provider_metadata_to_filesystem_traversal, from a malicious ContentProvider return a DISPLAY_NAME of ../../shared_prefs/x and confirm the file-picker plugin writes/reads outside its cache root while the app only called an innocent pick(); verify the secure build takes the basename / canonicalizes and confines under the cache root (Flutter file_picker CVE-2026-38093 plugin-boundary class).
• webview_cleartext_mixed_content_downgrade, with cleartext allowed and mixed-content set to ALWAYS_ALLOW, load an http:// (or mixed) page under mitmproxy, inject a script, and confirm it runs / a subresource downgrades HTTPS→HTTP; verify the secure build blocks cleartext and sets mixed-content to BLOCK so the load is refused (USENIX Security 2026 HTTP-in-WebView study).
• webview_safe_browsing_disabled, disable Safe Browsing (setSafeBrowsingEnabled(false) / manifest EnableSafeBrowsing=false), navigate to a known phishing/malware URL, and confirm it loads with no interstitial; verify the secure build keeps Safe Browsing on and blocks the bad URL while allowing benign ones (MASTG-TEST-0399).
• webview_remote_debugging_enabled, with setWebContentsDebuggingEnabled(true) in a release build, attach chrome://inspect and read the web-context session token; verify the secure build disables debugging in release builds (MASTG-TEST-0227).
• webview_url_loading_policy_confusion, feed the URL-policy handler (shouldOverrideUrlLoading / decidePolicyForNavigationAction) crafted URLs (javascript:, file:, look-alike subdomain, host-in-query) and confirm the naive contains-style check loads them; verify the secure handler canonicalizes + allowlists scheme AND exact host (MASTG-TEST-0332).

Privileged System-Provider Activation

• privileged_provider_activation_abuse, enable a system provider (accessibility / notification-listener / VPN / IME / phone-account / MediaProjection / credential-provider) with the confirming tap obscured by an overlay, then invoke the granted capability on an untrusted caller’s behalf; verify the secure build refuses an obscured/unconfirmed enablement and re-checks the caller on invoke (Android tapjack-to-enable CVE-2023-20913 class).
• mediaprojection_screencapture_authorization_bypass, start screen capture with a reused/forwarded/forged projection token and confirm recording begins; verify the secure build requires a single-use, unexpired token bound to the package that obtained consent (Android MediaProjection CVE-2025-32322 class).
• custom_keyboard_input_interception, type into a secure field in another app and confirm the custom keyboard / IME logs and exfiltrates the keystrokes (passwords/OTPs); verify the secure build never logs/transmits for secure fields and runs network-isolated (IME provider-privilege class).
• privileged_input_provider_injection, from an untrusted caller, inject synthetic key/motion events into the default IME and confirm they drive a sensitive action (e.g. auto-confirm a payment) in another app; verify the secure build refuses callers lacking the injection permission (Android IME event-injection CVE-2025-26450 class).
• companion_device_pairing_confusion, pair a spoofed/low-trust companion device and request a high-privilege capability (e.g. unlock door); confirm “paired” is treated as “authorized”; verify the secure build binds each capability to a per-capability trust check (CompanionDeviceManager class).
• device_policy_mdm_capability_abuse, from an untrusted caller, apply a device-wide policy (wipe / weaken password quality) and confirm it applies; verify the secure build requires the caller to be the active admin and validates the parameter (DevicePolicyManagerService CVE-2025-48553 class).
• vpn_provider_trust_anchor_abuse, connect the VPN tunnel to a rogue endpoint with an untrusted chain / mismatched hostname / user-installed CA and confirm it establishes (MITM possible); verify the secure build validates the tunnel trust anchor and refuses it (Prisma Access CVE-2026-0248 class).
• notification_intelligence_ai_processing, post a notification whose body carries an injected instruction and confirm the notification-intelligence AI obeys it (leaks the OTP / fires a smart action); verify the secure build redacts sensitive fields and treats notification text as untrusted data.
• assist_screen_context_ai_exposure, share the current screen (with a visible secret + an injected instruction) to the assistant and confirm the secret is shared and the assistant acts on the instruction; verify the secure build opts sensitive views out and treats captured text as data.