AI + Mobile (LLM x IPC / WebView)
The emerging crossover surface where an on-device AI assistant meets classic mobile trust boundaries: untrusted mobile input (deep links, clipboard, QR, notifications, WebView content) flowing INTO an LLM prompt, and LLM OUTPUT flowing back OUT into a WebView, an Intent/URL, or a tool/command invocation - without a validation boundary in between. Signalled by real 2025-2026 disclosures such as Microsoft 365 Copilot for iOS/Android (CVE-2026-26133, command injection) and Monica ChatGPT Assistant (CVE-2024-48142, prompt-injection data exfiltration).
5 vulnerabilities. OWASP Mobile: M4
| Vulnerability | ID | Platform | Difficulty | OWASP | MASVS | MASWE | MASTG (v2) | CWE |
|---|---|---|---|---|---|---|---|---|
| AI Output Used as Intent / URL (navigation & redirection) | ai_output_to_intent_url | AndroidiOS | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-PLATFORM-3 | MASWE-0032 | MASTG-TEST-0027MASTG-TEST-0026 | CWE-601CWE-441CWE-20 |
| Untrusted Mobile Input -> LLM Prompt (deep link / clipboard / QR) | untrusted_mobile_input_to_llm | AndroidiOS | MEDIUM | M4 | MASVS-PLATFORM-3MASVS-CODE-4 | MASWE-0050 | - | CWE-77CWE-20 |
| Accessibility Tree -> Indirect Prompt Injection | accessibility_tree_prompt_injection | AndroidiOS | HARD | M4 | MASVS-PLATFORM-1MASVS-CODE-4 | MASWE-0040 | - | CWE-77CWE-20CWE-441 |
| AI Output -> Tool / Command Injection | ai_output_command_tool_injection | AndroidiOS | HARD | M4 | MASVS-CODE-4MASVS-AUTH-3 | MASWE-0050 | - | CWE-77CWE-88CWE-862 |
| AI Output Rendered in WebView (XSS / local-file read) | ai_output_to_webview_xss | AndroidiOS | HARD | M4 | MASVS-PLATFORM-2MASVS-CODE-4 | MASWE-0034 | MASTG-TEST-0031MASTG-TEST-0033 | CWE-79CWE-73 |