iOS

158 iOS manual-verification steps, grouped by category. Each is a module that needs an external tool the in-app suite can’t drive.

Insecure Data Storage

  • insecure_local_storage, pull shared_prefs/*.xml (Android) or the app’s NSUserDefaults plist (iOS) via adb/objection and confirm the token/SSN/card are cleartext.
  • keychain_keystore_misuse, dump the Keychain with objection / keychain-dumper and confirm weak accessibility / no hardware backing.
  • insecure_backups, run adb backup (or a Finder/iMazing backup) and confirm app data is recoverable from the backup.
  • clipboard_leakage, copy a sensitive field, then read the clipboard from a second app / adb shell and confirm the secret is present.
  • screenshot_taskswitcher_leakage, background the app on a sensitive screen and inspect the task-switcher snapshot.
  • sensitive_data_in_logs, adb logcat / idevicesyslog while using the app; confirm PII/tokens are logged.
  • keyboard_cache_autofill_leakage, type into a sensitive field, then inspect the IME’s personalized-dictionary / autofill cache and confirm the secret was retained (field not marked no-suggestions / no-autofill).
  • temp_file_leftovers, browse the app cache/temp dirs and confirm sensitive leftovers.
  • third_party_sdk_data_leakage, proxy traffic with mitmproxy and confirm the SDK exfiltrates more than its stated purpose.
  • sensitive_data_in_memory, dump the process memory (fridump / objection / gdb) and recover the retained password/key.
  • keychain_state_integrity_manipulation, modify a Keychain/Keystore item the app treats as authoritative (e.g. a trust flag/signing key) and confirm the app acts on the tampered value; verify the secure build verifies an integrity tag/attestation and rejects it (iOS Keychain state-modification CVE-2026-28860 class).
  • keychain_access_group_authorization_confusion, from a different access group / extension read items stored under an over-broad or wildcard kSecAttrAccessGroup and confirm cross-group access; verify the secure build scopes items to an exact app-private group and refuses the read (iOS Keychain authorization CVE-2026-28864 class).
  • backup_archive_integrity_tampering, pull a backup, flip a persisted flag (e.g. is_premium/is_admin) or a balance, re-pack, restore, and confirm the app trusts the tampered state; verify the secure build verifies a keyed MAC over the archive and rejects it (CVE-2025-49199, MASTG-BEST-0065).
  • local_security_state_integrity_tampering, edit a UserDefaults / SharedPreferences / SQLite value that gates a security decision (role / entitlement) and confirm the app trusts it; verify the secure build binds the value to a keyed MAC / server authority and rejects the edit.
  • auth_state_rollback_restore, restore a stale session/token blob (old backup/snapshot) and confirm the app revives the ended/revoked session; verify the secure build validates freshness/revocation server-side and rejects the rolled-back state.
  • sensitive_data_in_crash_reports, trigger a crash and confirm the crash payload shipped to the crash service contains secrets/PII/request bodies; verify the secure build scrubs/allowlists the crash payload before sending.

Insufficient Cryptography

  • weak_algorithms, strings/jadx the binary and confirm a broken primitive (DES/RC4/MD5/SHA-1/ECB) is used; capture ciphertext and show the structural weakness (e.g. ECB pattern leakage).
  • hardcoded_keys_ivs, strings/jadx the binary and recover the key/IV.
  • insecure_random, sample the “random” token/nonce/OTP repeatedly and confirm it is predictable (java.util.Random / non-CSPRNG seed).
  • weak_key_derivation, capture the derived material and crack with hashcat given the low/absent iteration count.
  • custom_crypto_implementation, reverse the hand-rolled cipher with jadx/Ghidra and confirm it is trivially reversible (XOR / rolled AES) vs a platform primitive.
  • improper_mac_verification, flip a byte in an authenticated payload and confirm it is accepted (no constant-time MAC compare / MAC not checked).
  • improper_signature_verification, tamper a signed blob/update and confirm it is accepted (signature skipped or wrong key/no chain check).
  • device_secure_lock_not_enforced, run the app on a device with no screen lock and confirm sensitive features/keys are still available (no setUserAuthenticationRequired / secure-lock gate).
  • unauthenticated_encryption_malleable_ciphertext, bit-flip AES-CBC ciphertext (no MAC) and confirm the corresponding plaintext bit flips on decrypt (malleable / no integrity).
  • rsa_no_oaep_padding, confirm RSA uses PKCS#1 v1.5 (not OAEP) and demonstrate the padding-oracle distinguisher against the decrypt endpoint.

Insecure Authentication / Authorization

  • weak_session_management, capture the session token and confirm it is predictable / never rotated on privilege change / never expires (replay it after logout).
  • insecure_biometric_prompt, hook the auth callback with Frida and force the success path.
  • weak_password_policy, register/change password to a trivial value (123456, password) and confirm it is accepted (no length/complexity/breach check).
  • client_side_only_authorization, flip the client-side admin flag with Frida/objection and confirm privileged actions unlock.
  • jwt_vulnerabilities, forge an alg:none token / crack the weak secret with jwt_tool and confirm acceptance.
  • oauth_misconfiguration, capture the implicit-flow token from the redirect/logs under mitmproxy.
  • passkey_weak_attestation, register with none attestation via a WebAuthn test harness and confirm acceptance.
  • passkey_origin_binding_bypass, assert from an origin that merely contains the rpId and confirm acceptance.
  • passkey_credential_exfiltration, pull the credential store off-device and confirm private-key material is present.
  • passkey_fallback_downgrade, force “passkey unavailable” and confirm the weak fallback path is accepted.
  • passkey_assertion_replay_signcount, capture a WebAuthn assertion and replay it; confirm it is accepted again because the sign-count/credential counter is never compared (Craft CMS CVE-2026-72780 class).
  • passkey_challenge_reuse, record an assertion for the server’s challenge and replay it; confirm the static/reused challenge accepts it.
  • passkey_user_verification_bypass, submit an assertion with the UV flag unset under a userVerification=REQUIRED policy and confirm it is accepted (Spring Security CVE-2026-47841 class).
  • passkey_stepup_auth_bypass, trigger a sensitive action and confirm step-up is marked “verified” from a registered passkey without completing an assertion (New-API AI gateway CVE-2026-32879 class).
  • passkey_credential_management_authz, call the register/delete passkey endpoint as a different user and confirm you can add your own passkey or delete the victim’s (account takeover / lockout; USENIX 2026 class).
  • passkey_session_fixation, set a known pre-auth session id, complete a passkey assertion, and confirm the id is not rotated afterwards.
  • passkey_thirdparty_pairing_authz, approve a third-party authenticator / cross-device pairing and confirm no permission check gates it (Android CVE-2025-48640 / BLE CVE-2026-65935 class).
  • insecure_credential_manager, confirm a credential is associated with an unverified domain (no Digital Asset Links / AASA) and autofills into an insecure field.
  • username_enumeration, compare login responses for valid vs invalid usernames and confirm they differ.
  • insecure_password_reset_token, request multiple reset tokens/magic links and confirm they are short, related/predictable, and never expire.
  • developer_backdoor, decompile with jadx / strings and recover the hardcoded backdoor credential or debug route.
  • cross_app_otp_credential_leak, from a second (unprivileged) app, read the OTP / myauth:// auth deep link this app publishes on an unprotected exported component/broadcast/clipboard (Authenticator CVE-2026-26123 class); confirm an allowlisted/signature-checked channel yields nothing.
  • deeplink_authentication_bypass, fire a deep link (e.g. dvma://wallet) via adb while logged out and confirm it reaches the authenticated screen without the app-lock/login gate (Groww CVE-2026-12065 class).
  • biometric_authorization_not_bound, capture a biometric success for operation A and replay it to authorize operation B (the boolean isn’t tied to the operation), and overlay the prompt; verify the secure build binds the result to a per-operation signed challenge (CryptoObject) so it only authorizes the exact op (Android biometric-overlay CVE-2025-48528 class).
  • credential_provider_release_authorization, from a spoofed calling app / with an rpId mismatch (and no user-verification) extract a stored credential/passkey and enumerate entries; verify the secure build binds the calling app to the rpId, requires UV, and refuses enumeration (credential- provider release-boundary class).
  • multi_account_isolation_failure, log into account A, switch to / log into account B, and confirm A’s cached token/data is still readable (and A’s session survives logout); verify the secure build scopes per-account state to the active principal and wipes/rotates it on switch and logout.
  • identity_credential_presentation_binding, replay a captured mDL/mDoc (Identity Credential / ISO 18013-5) or Wallet identity presentation from a different session and confirm the verifier accepts it on issuer signature alone; verify the secure build binds the device signature to this session’s transcript + reader nonce and requires fresh user presence.

Insecure Communication

  • cleartext_traffic_allowed, confirm plain HTTP under mitmproxy.
  • weak_tls_config, run testssl.sh against the endpoint.
  • ssl_pinning_bypass, bypass pinning with objection/Frida and MITM.
  • accept_all_trust_manager, confirm any cert is accepted under MITM.
  • insecure_webview_networking, confirm mixed/cleartext content loads.

Improper Platform Usage

  • insecure_webview, reach the JS bridge / file:// and demonstrate RCE-style behavior.
  • deeplink_url_scheme_hijack, fire crafted deep links with adb.
  • over_privileged_permissions, review the manifest with aapt/jadx.
  • push_notification_leakage, inspect notification payloads / lockscreen.
  • qr_code_injection, scan a crafted QR and confirm unvalidated action.
  • zip_path_traversal, feed a zip-slip archive to the update unpacker.
  • photo_picker_over_access, review the manifest/Info.plist and confirm full media-library access is requested instead of the scoped photo picker.
  • dynamic_code_loading_rce, supply a malicious module/dex from a companion app or external storage and confirm it executes unverified.
  • deeplink_to_webview_navigation, send a deep link whose url param points off-origin (or javascript:/file://) and confirm it loads in the trusted WebView with no origin allowlist (TikTok CVE-2024-45240 / Rakuten CVE-2024-41918 / EcoOnline CVE-2026-26897 class).
  • inapp_browser_ui_spoofing, load attacker content that sets a fake title/origin and confirm the in-app browser address bar shows a trusted origin while the real committed URL is the attacker’s (Firefox Focus CVE-2025-10290 / LINE CVE-2024-5739 class).
  • custom_url_scheme_authorization, adb shell am start/xcrun simctl openurl a dvma://open?url=https://attacker.example and confirm the app loads the attacker site with no caller/allowlist check (Rakuten CVE-2024-41918 / @cosme CVE-2024-45203 / Groww CVE-2026-12065 class).
  • wkwebview_untrusted_url_local_file, inject HTML/JS into a reflected field and confirm the WebView (with file access enabled) can read the app’s local files; verify the secure build escapes output and disables file access (ZOLL ePCR iOS CVE-2025-12699 class).
  • ssrf_url_media_handler, pass an internal/loopback/metadata URL (http://169.254.169.254/...) to the media/URL loader and confirm the app fetches it; verify the secure build allowlists public hosts only (WhatsApp iOS CVE-2026-23866 class).
  • qr_url_no_validation, scan a QR encoding a javascript: or privileged dvma:// payload and confirm it is opened/navigated with no validation (Firefox iOS QR-scanner CVE-2025-54145 class).
  • proximity_transfer_unsafe_parsing, feed a malformed plist / deeply nested XML entity-expansion bomb as a proximity-transfer (AirDrop/Quick Share) payload and confirm the naive parser blows up (huge expansion / state confusion) with no pairing; verify the secure build caps depth, entity expansion, and size and rejects it (AirDrop & Quick Share proximity-protocol research class).
  • shortcuts_path_symlink_sandbox_escape, drive a Shortcut/App-Intents file op with a ../ or symlinked path and confirm it resolves outside the app container to a sensitive file; verify the secure build canonicalizes and confines the real path to the container (iOS Shortcuts CVE-2026-20677 / CVE-2026-20653 class).
  • app_intent_parameter_authorization, invoke a privileged App Intent/Shortcut (transfer/export) with an untrusted parameter targeting another user’s entity and confirm it runs with no authorization; verify the secure build requires a verified auth token and an ownership check (Apple App Intents capability-confusion class).
  • clipboard_unauthorized_write_integrity, from untrusted content (a page in the app WebView / another app) overwrite the system clipboard with no user gesture and confirm the user pastes attacker-controlled data (e.g. a swapped crypto address); verify the secure build requires a trusted origin + user gesture (Lenovo Android web-to-clipboard CVE-2026-7516 class).
  • clipboard_to_privileged_action_injection, seed the clipboard from an untrusted origin and confirm it flows into a privileged action (auto-paste into a payment/command field / automation step) with no validation; verify the secure build validates/allowlists the value and requires explicit confirmation (webpage → clipboard → automation → privileged capability; CVE-2026-17766 class).
  • document_picker_trusted_file_confusion, return a document from the system picker whose declared type/path is hostile (mislabeled type, a path into a privileged location) and confirm the app trusts it into a sensitive sink; verify the secure build re-validates real content/type and confines the path (Document Picker / security-scoped-URL trust class).
  • system_surface_privileged_appintent_exposure, fire a privileged App Intent from a surface that shouldn’t be allowed to (Widget/Control/Action Button) with no unlock and confirm it runs; verify the secure build enforces per-surface authorization + auth for sensitive intents (Apple App Intents multi-surface exposure class).
  • unauthenticated_local_loopback_service, hit the app’s loopback HTTP/TCP or unix-domain socket from a co-resident app or a DNS-rebinding web origin (no token) and confirm privileged data/functionality is served; verify the secure build requires a per-session token and validates the Origin/Host, rejecting rebinding + untokened callers.
  • zero_click_call_media_parse_sink, deliver a crafted call/media payload that reaches the parser with no user interaction and confirm it is parsed unsafely (crash / state confusion) at the zero-click sink.
  • platform_version_security_fallback, run on an OS below the feature threshold and confirm the if (SDK_INT >= X) guard silently drops to an insecure path (no hardware key backing); verify the secure gate fails closed on the unsupported OS.
  • notification_action_authorization_bypass, trigger a notification action (Android trampoline receiver→activity / iOS UNNotificationAction) that approves a transfer with no fresh auth; verify the secure build routes every surface through the same authorization check and re-auths destructive actions.
  • handoff_useractivity_injection, hand off a crafted NSUserActivity whose userInfo targets another account’s resource and confirm the receiving app applies it; verify the secure build validates activityType, binds the activity to the authenticated account, and treats userInfo as untrusted.
  • universal_link_aasa_confusion, craft a Universal Link that exploits a broad AASA path/wildcard or an open redirect to reach a sensitive handler; verify the secure build uses tight exact-path matching and re-validates params.
  • app_clip_invocation_injection, craft an App Clip invocation URL (or spoof the QR/NFC trigger) that performs a purchase/account action and confirm it inherits full-app auth; verify the secure build validates the invocation against the associated domain and re-authenticates sensitive actions.
  • ios_capability_composition_chain, open the crafted Universal Link and confirm it drives App Intent perform() → security-scoped bookmark → Contacts export with no user authorization; verify the secure build treats the link as untrusted, requires fresh authorization at the App Intent for the protected-data action, and re-validates the bookmark scope before the sink.

Code Quality & Build Config

  • debuggable_release_build, confirm debuggable=true in the release APK.
  • no_obfuscation, confirm readable symbols with jadx/nm.
  • verbose_error_handling, trigger an error path (bad input, forced failure) and confirm the response/UI/log leaks a stack trace, SQL, or internal path instead of a generic message.
  • vulnerable_dependencies, run osv-scanner / dependency-check.
  • native_code_memory_bugs, analyze the native lib in Ghidra; trigger the overflow.

Insufficient Resilience

  • root_jailbreak_detection_bypass, bypass with objection/Frida.
  • anti_debugging_bypass, patch out the debugger check.
  • anti_tampering_integrity_bypass, modify the APK and confirm it runs.
  • emulator_detection_bypass, spoof build props and bypass.
  • frida_detection_bypass, disable the Frida string check.
  • toctou_race_condition, win the check-to-use race.
  • malware_detection_absent, install a known-bad/sideloaded companion and confirm the app performs no on-device threat check before handling secrets.
  • device_attestation_absent, confirm the server accepts requests with no hardware key-attestation / DeviceCheck evidence, so a rooted/emulated device is trusted.
  • app_attestation_absent, MITM the app’s API and confirm no app attestation (Play Integrity / App Attest) token is required, so a repackaged/emulated client is served normally.

Supply Chain (OWASP Mobile M2)

  • malicious_third_party_sdk, confirm exfiltration under mitmproxy.
  • typosquatted_dependency, review pubspec for the lookalike name.
  • unsigned_unverified_build_artifact, verify with apksigner and confirm the update path skips signature/checksum checks.
  • insecure_firebase_cloud_config, extract the Firebase/cloud URL + keys with jadx/strings and confirm an unauthenticated read returns other users’ data (curl / mitmproxy).
  • sbom_missing_or_stale, confirm the build produces no Software Bill of Materials; generate one (e.g. CycloneDX) and cross-reference bundled SDK versions against advisories to reveal the components that were invisible.
  • silent_sdk_auto_update, under mitmproxy, serve a modified remote “SDK behavior” payload and confirm it is applied at runtime with no signature/checksum check, changing app behavior post-install (SpinOK-style).
  • dependency_confusion, confirm an internal/private package name can be resolved from a public registry (pubspec/CocoaPods/SPM), so a higher public version would be pulled over the trusted private one; confirm scoped/pinned resolution prevents it (iOS dependency-management research class).
  • sdk_exported_component_redirection, with drozer/adb, deliver a nested “forward” intent to a bundled SDK’s exported component and confirm it redirects to a private component (leaking credentials) with the host app’s privileges (EngageLab SDK class); confirm the allowlisted handler refuses.

Privacy (OWASP Mobile M6)

  • missing_consent_before_data_access, confirm data access with no consent screen.
  • no_tracking_transparency_prompt, confirm tracking with no ATT prompt.
  • pii_in_analytics_events, capture analytics events under mitmproxy.
  • installed_app_enumeration, confirm the app probes a broad scheme/package list (iOS canOpenURL / Android queryIntentActivities) and builds an installed-app fingerprint with no functional need; verify the secure build checks only its one declared scheme (iOS CVE-2026-20641 class).
  • cross_app_browser_history_access, read browsing history belonging to another app / the system browser with no consent; verify the secure build requires explicit consent and scoping (iOS CVE-2026-20656 Safari-history class).
  • notification_alternate_surface_disclosure, trigger a notification redacted on the lock screen and confirm its full content renders on a secondary surface (DeX/desktop mode, widget, companion display); verify the secure build applies the same redaction policy on every unauthenticated surface (Samsung DeX CVE-2026-21006 class).
  • lock_state_confusion_data_exposure, while the device is LOCKED, reach sensitive content/action through an accessibility / notification / widget / VoiceOver path that never re-checks the keyguard; verify the secure build re-checks lock state and redacts (iOS CVE-2026-20645 / CVE-2026-20661 class).
  • privacy_control_alternate_path_bypass, read protected data through an alternate path (a different API, a shared app-group container, a cached copy) that sidesteps the consent gate; verify the secure build funnels all reads through the single consent-checked accessor (iOS CVE-2026-20606 class).
  • assistant_locked_device_capability_abuse, invoke a Siri/App-Intents/voice capability on a LOCKED device and confirm it exposes sensitive info or runs a privileged action without unlocking; verify the secure build re-checks authentication for sensitive capabilities (iOS Siri locked-device CVE-2026-28856 class).

Input Validation (OWASP Mobile M4)

  • unsafe_deserialization, craft a malicious serialized payload.
  • unsafe_media_decoding, feed a crafted image (spoofed huge dimensions / decompression bomb / unexpected format) and confirm the app decodes it with no size/type/dimension validation (Samsung CVE-2025-21043 class); confirm the safe decoder rejects it on caps + format allowlist.
  • deeplink_regex_dos, send a crafted deep link that triggers catastrophic regex backtracking in link parsing and confirm the app freezes/hangs (Mattermost CVE-2024-3872 class); confirm the linear/anchored parser stays responsive.
  • protected_data_access_via_input_validation, send an evasive identifier (encoded / .. / case / unicode variant such as users/./admin/%2E%2E/admin/SSN) that slips a protected id past a naive deny check and returns protected data; verify the secure build canonicalizes FIRST and checks the canonical form (Apple protected-data-via-input-sanitization CVE-2026-43714 class).

AI/ML (OWASP LLM/GenAI Top 10)

  • prompt_injection_indirect, encode hidden instructions in a scanned QR/image/file and confirm the assistant obeys them.
  • insecure_output_handling, confirm LLM output is rendered/executed unsanitized.
  • excessive_agent_agency, confirm a tool call fires with no confirmation.
  • hardcoded_llm_api_keys, strings/jadx the binary and recover the key.
  • insecure_ondevice_model_storage, locate and swap the model file.
  • unverified_model_supply_chain, MITM the model update and serve a tampered model with no checksum failure.
  • unbounded_ai_resource_consumption, script rapid AI calls and confirm no rate limiting.
  • rag_vector_store_poisoning, ingest a poisoned document, then run an unrelated query and confirm the poisoned entry is retrieved and obeyed.
  • hidden_context_exposure, confirm private/other-tenant context is surfaced to the model/user (no context partitioning).
  • ondevice_model_extraction, pull the on-device model file and confirm the weights are extractable (unencrypted/unsigned).
  • unicode_invisible_prompt_injection, craft text with zero-width / RTL-override characters and confirm the assistant obeys the hidden instruction (input not sanitized).

Agentic AI (OWASP Agentic Top 10)

  • agent_memory_poisoning, plant an instruction in the agent’s persistent memory and confirm it re-fires in a later session after reset.
  • mcp_tool_poisoning, connect a tool/MCP server whose description carries hidden directives and confirm the agent obeys them during planning.
  • agent_tool_confused_deputy, cause the agent to reuse the app’s ambient permission/credential for an unauthorized action with no re-auth.
  • insecure_inter_agent_comms, spoof a message between sub-agents and confirm the receiver acts on the unauthenticated message.
  • mcp_open_url_arbitrary_intent, via prompt injection, drive the agent’s mobile_open_url MCP tool to a dangerous scheme (tel:, sms:, content://, intent://) and confirm it is dispatched to startActivity() with no allowlist; verify the secure build allows only http/https and requires user confirmation (Mobile MCP CVE-2026-35394 class).

AI + Mobile (LLM x IPC / WebView)

  • untrusted_mobile_input_to_llm, deliver a prompt-injection payload over a mobile trust boundary (deep-link param, clipboard, scanned QR, notification) and confirm it is concatenated into the assistant prompt and obeyed; verify the secure build treats it as quoted data (Monica CVE-2024-48142 class).
  • ai_output_to_webview_xss, steer the model to emit HTML/JS, confirm it executes when rendered into the WebView unescaped, and that the secure build escapes/sanitizes it (FAQ-Bot CVE-2025-63639 / ZOLL ePCR CVE-2025-12699 class).
  • ai_output_to_intent_url, steer the model to emit a URL/intent and confirm it is launched with no allowlist/confirmation; verify the secure build allowlists + confirms first.
  • ai_output_command_tool_injection, steer the model to emit a tool/command call and confirm it executes with app privileges before any validation; verify the secure build uses an allowlisted tool registry with argument validation (Microsoft 365 Copilot iOS/Android CVE-2026-26133 class).
  • accessibility_tree_prompt_injection, plant imperative text in an on-screen/a11y node (e.g. “IGNORE PREVIOUS INSTRUCTIONS…”) and confirm the agent, which builds its prompt from the accessibility tree, obeys it and takes an unauthorized action; verify the secure build treats UI/a11y text as quoted untrusted data and ignores it (Android Accessibility mobile-agent injection research).

Native / WebView Bridge (JS <-> Native)

  • js_bridge_callback_id_injection, from web content, post a bridge message naming another plugin’s callbackId and confirm you receive that plugin’s native result (Camera/Contacts/Files/Geolocation); verify the secure build validates the callback id (regex + plugin ownership) and rejects it (Cordova InAppBrowser iOS CVE-2026-47430 class).
  • crossorigin_iframe_to_native_bridge, deliver a bridge message from a cross-origin iframe and confirm the handler acts on it and returns the access/session token; verify the secure build requires isMainFrame and a trusted origin and blocks it (Home Assistant Companion CVE-2026-44698 class, Android addJavascriptInterface / iOS WKUserContentController).
  • js_bridge_exposes_privileged_api, from an arbitrary loaded page, call a bridge method that returns an auth token / reads a file (or reaches camera/location) and confirm it succeeds with no gate; verify the secure build enforces an origin allowlist + capability check.
  • qr_nfc_to_privileged_action, feed a QR/NFC payload from an untrusted caller and confirm the named automation/action fires with no user confirmation; verify the secure build requires a trusted source and an explicit confirmation (Home Assistant Companion GHSA NFC/QR class).
  • webview_origin_confusion_ipc, invoke a local-only privileged IPC command from a remote origin (e.g. https://tauri.localhost.evil.com) and confirm the loose origin classifier treats it as local and executes it; verify the secure build compares the canonical origin (scheme+host+port) exactly and rejects the remote page (Tauri WebView IPC origin confusion CVE-2026-42184 class).
  • webview_js_injection_ssl_bypass, with the accept-all TLS handler, MITM the WebView load, inject <script>, and confirm a token is exfiltrated / a privileged action fires; verify the secure build validates the certificate so the forged/MITM content never loads (PayRange CVE-2026-13461 class).
  • embedded_miniapp_secret_exposure, read the embedded Mini-App’s WebView storage over the JS↔native bridge and confirm a plaintext, replayable auth token (and a recovery secret such as a wallet mnemonic) is exposed to any origin; verify the secure build issues an origin-bound, single-use handle and never exposes the mnemonic (Telegram Mini App / TENET research class).
  • webview_sop_csp_disabled, with universal file access on and no CSP, confirm a file:// page reads a cross-origin resource and runs inline script in the app origin (token read); verify the secure build disables universal access and enforces a restrictive CSP (WebKit SOP CVE-2026-20643 / CSP CVE-2026-20665 app-level analog).
  • shared_webview_miniapp_isolation, from mini-app A, read mini-app B’s cookie/localStorage out of the shared WebView jar; verify the secure build partitions storage per mini-app origin so A cannot see B (WeChat/Alipay cross-mini-program cookie-sharing research class).
  • webview_cleartext_mixed_content_downgrade, with cleartext allowed and mixed-content set to ALWAYS_ALLOW, load an http:// (or mixed) page under mitmproxy, inject a script, and confirm it runs / a subresource downgrades HTTPS→HTTP; verify the secure build blocks cleartext and sets mixed-content to BLOCK so the load is refused (USENIX Security 2026 HTTP-in-WebView study).
  • webview_url_loading_policy_confusion, feed the URL-policy handler (shouldOverrideUrlLoading / decidePolicyForNavigationAction) crafted URLs (javascript:, file:, look-alike subdomain, host-in-query) and confirm the naive contains-style check loads them; verify the secure handler canonicalizes + allowlists scheme AND exact host (MASTG-TEST-0332).

Privileged System-Provider Activation

  • vpn_provider_trust_anchor_abuse, connect the VPN tunnel to a rogue endpoint with an untrusted chain / mismatched hostname / user-installed CA and confirm it establishes (MITM possible); verify the secure build validates the tunnel trust anchor and refuses it (Prisma Access CVE-2026-0248 class).
  • app_group_shared_container_amplification, read the auth token from the App Group shared container as a low-trust extension and confirm it is returned; verify the secure build scopes sensitive items per-entitlement so a low-trust reader is denied (Apple App Group class, MASTG-BEST-0068).
  • extension_activation_input_confusion, hand a crafted NSItemProvider payload (traversal file URL / javascript: URL) to a Share/Action extension and confirm it acts on activation alone; verify the secure build validates the payload type/content before acting (activation != authorization).
  • lockscreen_control_action_authorization, invoke a sensitive Control Widget / App Intent from the Lock Screen on a locked device and confirm it runs with no auth; verify the secure build requires unlock/biometric for sensitive intents regardless of surface (WidgetKit Controls class).