https://cpeoples.github.io/dvma/vulnerabilities/detail/index.htmlPer-vulnerability detail pages.HugoenThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/accept_all_trust_manager/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/accept_all_trust_manager/index.htmlCustom certificate callback accepts any certificate.https://cpeoples.github.io/dvma/vulnerabilities/detail/accessibility_tree_prompt_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/accessibility_tree_prompt_injection/index.htmlAn on-device AI agent perceives the screen through the Android accessibility tree / visible UI text and feeds it into its prompt unfiltered, so untrusted…https://cpeoples.github.io/dvma/vulnerabilities/detail/accessibility_service_privilege_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/accessibility_service_privilege_abuse/index.htmlAn AccessibilityService performs a privileged action (launching an activity from the background, hiding/suppressing UI, injecting a gesture/click) with…https://cpeoples.github.io/dvma/vulnerabilities/detail/activity_task_stack_hijacking/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/activity_task_stack_hijacking/index.htmlLoose task affinity / launch modes (singleTask + shared taskAffinity, allowTaskReparenting) let a malicious Activity insert itself into a trusted app's…https://cpeoples.github.io/dvma/vulnerabilities/detail/activity_alias_exposure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/activity_alias_exposure/index.htmlA protected/internal Activity is left reachable through an that is exported=true (or lacks the target's permission), so an attacker launches…https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_state_toctou_swap/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_state_toctou_swap/index.htmlThe agent validates an external resource (a config file / API response) and then reads it again at use time; a swap between check and use makes it act on…https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_memory_poisoning/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_memory_poisoning/index.htmlA malicious instruction is written to the agent's persistent memory and re-fires across future sessions after the context resets (MINJA-style).https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_recovery_loop_weaponization/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_recovery_loop_weaponization/index.htmlThe agent's own error/task-recovery logic ('if stuck, tap back and retry') is steered by attacker-planted on-screen hints into a programmable multi-step…https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_tool_confused_deputy/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/agent_tool_confused_deputy/index.htmlThe agent reuses the app's own permissions/credentials to perform an unauthorized action on behalf of untrusted input (confused deputy).https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_command_tool_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_command_tool_injection/index.htmlThe assistant maps model output to a tool/command invocation and executes it (with the app's privileges) before any validation, so attacker-influenced output…https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_to_webview_xss/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_to_webview_xss/index.htmlLLM output is injected into a WebView via loadHtmlString/evaluateJavascript with no encoding, so model-produced (attacker-influenced) HTML/JS executes in the…https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_to_intent_url/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/ai_output_to_intent_url/index.htmlThe assistant's output is fed directly into startActivity()/url launcher, so a prompt-injected model can drive navigation, open redirects, or fire intents on…https://cpeoples.github.io/dvma/vulnerabilities/detail/android_capability_composition_chain/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/android_capability_composition_chain/index.htmlNo single hop is the bug - the COMPOSITION is. A notification action carries a mutable PendingIntent -> it fires an exported BroadcastReceiver -> the receiver…https://cpeoples.github.io/dvma/vulnerabilities/detail/anti_debugging_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/anti_debugging_bypass/index.htmlDebugger check is a single function trivially patched out.https://cpeoples.github.io/dvma/vulnerabilities/detail/anti_tampering_integrity_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/anti_tampering_integrity_bypass/index.htmlIntegrity check never verifies anything meaningful (always passes).https://cpeoples.github.io/dvma/vulnerabilities/detail/app_attestation_absent/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/app_attestation_absent/index.htmlThe backend accepts requests without an app-attestation token proving they come from a genuine, unmodified build, so a repackaged or scripted client is…https://cpeoples.github.io/dvma/vulnerabilities/detail/app_clip_invocation_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/app_clip_invocation_injection/index.htmlAn App Clip acts on its invocation parameters (invocation URL / NFC / QR / associated-domain payload) - performing a purchase, order, or account action - while…https://cpeoples.github.io/dvma/vulnerabilities/detail/extension_activation_input_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/extension_activation_input_confusion/index.htmlAn iOS app extension (Share / Action / File Provider / etc.) trusts the item it is handed simply because the system activated it - activation rules decide WHEN…https://cpeoples.github.io/dvma/vulnerabilities/detail/app_group_shared_container_amplification/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/app_group_shared_container_amplification/index.htmlThe app stores secrets (tokens, credentials, keys) in an App Group shared container / shared UserDefaults that every member of the group can read/write with no…https://cpeoples.github.io/dvma/vulnerabilities/detail/app_intent_parameter_authorization/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/app_intent_parameter_authorization/index.htmlAn App Intent / Siri / Shortcuts / Spotlight entry point maps an untrusted, system-supplied parameter straight to a privileged app action (transfer, delete…https://cpeoples.github.io/dvma/vulnerabilities/detail/virtualization_detection_absent/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/virtualization_detection_absent/index.htmlThe app never detects that it is running inside an app-virtualization / cloning container (VirtualApp-style host, dual-app/work-profile clone), where a…https://cpeoples.github.io/dvma/vulnerabilities/detail/remoteviews_widget_action_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/remoteviews_widget_action_injection/index.htmlAn app-widget builds RemoteViews whose click/action PendingIntent is derived from attacker-influenceable widget-configuration state (config-activity extras…https://cpeoples.github.io/dvma/vulnerabilities/detail/assist_screen_context_ai_exposure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/assist_screen_context_ai_exposure/index.htmlThe app over-shares current-screen context through the Assist API (or fails to opt sensitive views out), so the system assistant / AI receives sensitive…https://cpeoples.github.io/dvma/vulnerabilities/detail/auth_state_rollback_restore/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/auth_state_rollback_restore/index.htmlThe app treats a locally-persisted session/token as authoritative and never checks freshness/revocation server-side, so restoring an OLD local state (from a…https://cpeoples.github.io/dvma/vulnerabilities/detail/authorization_by_mutable_resource_state/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/authorization_by_mutable_resource_state/index.htmlA security/authorization decision is made on mutable resource existence or state (e.g. doesFileExist() -> grant access -> the file is then created/changed), so…https://cpeoples.github.io/dvma/vulnerabilities/detail/background_activity_launch_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/background_activity_launch_abuse/index.htmlAn untrusted / local caller drives a background component to startActivity() reaching security-sensitive UI, so with no background-activity-launch restriction…https://cpeoples.github.io/dvma/vulnerabilities/detail/backup_archive_integrity_tampering/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/backup_archive_integrity_tampering/index.htmlThe app does not verify the INTEGRITY of a backup archive before restoring it, so an attacker extracts a backup, edits persisted state (entitlements, balances…https://cpeoples.github.io/dvma/vulnerabilities/detail/biometric_authorization_not_bound/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/biometric_authorization_not_bound/index.htmlThe biometric prompt returns a boolean success that is NOT cryptographically bound to the specific operation being authorized (no CryptoObject / no signed…https://cpeoples.github.io/dvma/vulnerabilities/detail/contacts_provider_blind_sqli_oracle/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/contacts_provider_blind_sqli_oracle/index.htmlA provider accepts a crafted WHERE/selection clause on a legacy code path with no strict-SQL hardening, so a permission-less caller uses a balanced subquery as…https://cpeoples.github.io/dvma/vulnerabilities/detail/sdk_exported_component_redirection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/sdk_exported_component_redirection/index.htmlA bundled third-party SDK ships its own vulnerable exported component that intent-redirects, so another app abuses the SDK (not the host app's code) to reach…https://cpeoples.github.io/dvma/vulnerabilities/detail/cleartext_traffic_allowed/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/cleartext_traffic_allowed/index.htmlApp sends requests over plain HTTP; cleartext permitted in manifest/plist.https://cpeoples.github.io/dvma/vulnerabilities/detail/client_side_only_authorization/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/client_side_only_authorization/index.htmlAdmin-only actions gated purely by a client-side boolean flag.https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_to_privileged_action_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_to_privileged_action_injection/index.htmlClipboard content sourced from an untrusted origin flows into a privileged action (auto-paste into a payment/command field, an assistant/automation step) with…https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_leakage/index.htmlCopies passwords/tokens to the global clipboard readable by any app.https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_unauthorized_write_integrity/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/clipboard_unauthorized_write_integrity/index.htmlUntrusted content (a page loaded in the app's WebView, or another app) can OVERWRITE the system clipboard through the app with no user gesture / origin check…https://cpeoples.github.io/dvma/vulnerabilities/detail/clipdata_uri_grant_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/clipdata_uri_grant_leakage/index.htmlThe app attaches a private content:// URI to an Intent's ClipData (or copies it) together with FLAG_GRANT_READ_URI_PERMISSION and fires it to an implicit /…https://cpeoples.github.io/dvma/vulnerabilities/detail/companion_device_pairing_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/companion_device_pairing_confusion/index.htmlAn app pairs with a nearby companion device (watch / peripheral / car / IoT) via CompanionDeviceManager and then treats 'paired' as 'authorized for every…https://cpeoples.github.io/dvma/vulnerabilities/detail/confused_deputy_intent_validation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/confused_deputy_intent_validation/index.htmlA privileged component performs an action on behalf of a caller after only a superficial Intent check, letting a local app abuse the app's privileges (Android…https://cpeoples.github.io/dvma/vulnerabilities/detail/content_provider_sql_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/content_provider_sql_injection/index.htmlExported content provider builds SQL by string concatenation.https://cpeoples.github.io/dvma/vulnerabilities/detail/content_uri_resolver_confused_deputy/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/content_uri_resolver_confused_deputy/index.htmlThe app takes an attacker-supplied content:// URI (e.g. from an intent extra) and reads it through its OWN ContentResolver, so it becomes a proxy for a…https://cpeoples.github.io/dvma/vulnerabilities/detail/contentprovider_filename_path_traversal/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/contentprovider_filename_path_traversal/index.htmlA ContentProvider / file-import API takes the caller-supplied display name / filename and writes or reads it under the app's storage with no canonicalization…https://cpeoples.github.io/dvma/vulnerabilities/detail/credential_provider_release_authorization/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/credential_provider_release_authorization/index.htmlA credential-provider / password-manager extension releases a stored credential or passkey assertion without validating the calling app / relying-party…https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_browser_history_access/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_browser_history_access/index.htmlThe app reads browsing history that belongs to another app / the system browser (a shared or world-readable history store) with no user consent, exposing the…https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_otp_credential_leak/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_otp_credential_leak/index.htmlA co-resident malicious app can read OTP codes / auth deep links from this app via an unprotected exported component, broadcast, or shared clipboard…https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_scripting/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_app_scripting/index.htmlAn exported activity takes an attacker-controlled Intent value and passes it to WebView loadUrl()/evaluateJavascript() without validation, giving JS execution…https://cpeoples.github.io/dvma/vulnerabilities/detail/crossorigin_iframe_to_native_bridge/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/crossorigin_iframe_to_native_bridge/index.htmlThe JS-bridge message handler does not verify the message came from the main frame / trusted origin, so a cross-origin iframe reaches the bridge, runs JS in…https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_profile_data_capability_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/cross_profile_data_capability_leakage/index.htmlManaged (work) and primary (personal) profiles are a security boundary, but the app crosses it unsafely - forwarded intents, URI grants, shared files…https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_crypto_implementation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_crypto_implementation/index.htmlA homegrown XOR-based 'encryption' scheme trivially reversible.https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_signature_permission_squatting/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_signature_permission_squatting/index.htmlAn IPC component is 'protected' by a custom permission whose protectionLevel is normal/dangerous (not signature), or by a permission name a malicious app can…https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_keyboard_input_interception/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_keyboard_input_interception/index.htmlA custom keyboard / InputMethodService (or iOS keyboard extension) captures sensitive input typed in OTHER apps - passwords, OTPs, financial data, passkey/AI…https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_url_scheme_authorization/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/custom_url_scheme_authorization/index.htmlA custom URL-scheme handler loads a caller-supplied URL without checking the caller or an allowlist, so any co-resident app can make DVMA display an attacker…https://cpeoples.github.io/dvma/vulnerabilities/detail/debuggable_release_build/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/debuggable_release_build/index.htmlRelease build ships with debuggable=true / debug flags left on.https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_to_webview_navigation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_to_webview_navigation/index.htmlA URL parameter from an incoming deep link/intent is loaded straight into a trusted WebView with no origin allowlist, so an attacker renders arbitrary content…https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_url_scheme_hijack/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_url_scheme_hijack/index.htmlCustom scheme is unvalidated and can be claimed/abused by another app.https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_authentication_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_authentication_bypass/index.htmlA deep link routes directly to an authenticated screen/function, skipping the app-lock / login gate the normal navigation path enforces (Groww CVE-2026-12065…https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_regex_dos/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/deeplink_regex_dos/index.htmlA catastrophically-backtracking regex parses incoming deep-link URLs, so a crafted link freezes/hangs the app (Mattermost CVE-2024-3872 class).https://cpeoples.github.io/dvma/vulnerabilities/detail/default_role_holder_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/default_role_holder_confusion/index.htmlThe app resolves a system role (default browser / dialer / SMS / wallet / credential provider / NFC handler) with resolveActivity() / an implicit intent and…https://cpeoples.github.io/dvma/vulnerabilities/detail/dependency_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/dependency_confusion/index.htmlAn internal/private package name is resolved from a public registry, so an attacker who publishes that name to the public index gets their impostor pulled into…https://cpeoples.github.io/dvma/vulnerabilities/detail/developer_backdoor/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/developer_backdoor/index.htmlA hidden hardcoded backdoor credential / debug route grants privileged access.https://cpeoples.github.io/dvma/vulnerabilities/detail/device_attestation_absent/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/device_attestation_absent/index.htmlThe app trusts the client environment without requesting a hardware-backed device-integrity verdict (Play Integrity on Android, DeviceCheck/App Attest on iOS)…https://cpeoples.github.io/dvma/vulnerabilities/detail/device_policy_mdm_capability_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/device_policy_mdm_capability_abuse/index.htmlA Device Admin / DevicePolicyManager receiver acts as a device-wide policy authority but validates policy parameters or caller/state insufficiently, so…https://cpeoples.github.io/dvma/vulnerabilities/detail/device_secure_lock_not_enforced/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/device_secure_lock_not_enforced/index.htmlA secret is persisted without requiring a device secure lock (PIN/passcode/biometric) or binding the key to it, so on a device with no lock screen the secret…https://cpeoples.github.io/dvma/vulnerabilities/detail/prompt_injection_direct/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/prompt_injection_direct/index.htmlUser input can override the assistant's system instructions.https://cpeoples.github.io/dvma/vulnerabilities/detail/document_picker_trusted_file_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/document_picker_trusted_file_confusion/index.htmlThe app assumes a file returned by the system document / file picker (or a security-scoped URL) is trustworthy simply because the OS handed it over, and feeds…https://cpeoples.github.io/dvma/vulnerabilities/detail/dynamic_broadcast_receiver_exposure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/dynamic_broadcast_receiver_exposure/index.htmlA runtime-registered receiver (registerReceiver() without RECEIVER_NOT_EXPORTED / a signature permission) is implicitly exported, so any co-resident app can…https://cpeoples.github.io/dvma/vulnerabilities/detail/dynamic_code_loading_rce/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/dynamic_code_loading_rce/index.htmlLoads and executes a dex/module/plugin from an untrusted third-party app or external storage with no verification.https://cpeoples.github.io/dvma/vulnerabilities/detail/embedded_miniapp_secret_exposure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/embedded_miniapp_secret_exposure/index.htmlAn embedded web-app / Mini-App persists plaintext, replayable auth tokens (and recovery secrets such as wallet mnemonics) in WebView storage reachable over the…https://cpeoples.github.io/dvma/vulnerabilities/detail/emulator_detection_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/emulator_detection_bypass/index.htmlEmulator check reads easily-spoofed build properties.https://cpeoples.github.io/dvma/vulnerabilities/detail/excessive_agent_agency/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/excessive_agent_agency/index.htmlAssistant has tool-calling (e.g. send message) with no confirmation.https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_android_components/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_android_components/index.htmlActivities/services/receivers exported with no permission checks.https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_broadcast_receiver_spoof/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_broadcast_receiver_spoof/index.htmlAn exported BroadcastReceiver accepts broadcasts from any app and trusts their extras, so a local app spoofs data the app treats as authoritative (e.g. device…https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_component_arbitrary_url_activity/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_component_arbitrary_url_activity/index.htmlAn exported component takes an attacker-supplied URL/activity target and opens it with the app's identity/privileges (ABEMA CVE-2024-28745 / Samsung Members…https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_component_state_manipulation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/exported_component_state_manipulation/index.htmlAn exported component accepts an attacker-controlled identifier in its intent extras and performs a security-sensitive STATE CHANGE (e.g. cancelling the…https://cpeoples.github.io/dvma/vulnerabilities/detail/file_descriptor_capability_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/file_descriptor_capability_leakage/index.htmlThe app passes an open ParcelFileDescriptor (via Binder, openFile(), or detachFd()) to an untrusted caller for a file/socket the caller could not otherwise…https://cpeoples.github.io/dvma/vulnerabilities/detail/fileprovider_path_traversal/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/fileprovider_path_traversal/index.htmlAn over-broad FileProvider / grantUriPermissions lets another app read arbitrary app-private files via a traversal path.https://cpeoples.github.io/dvma/vulnerabilities/detail/frida_detection_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/frida_detection_bypass/index.htmlFrida detection greps for a fixed string easily disabled.https://cpeoples.github.io/dvma/vulnerabilities/detail/gui_agent_action_rebinding/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/gui_agent_action_rebinding/index.htmlA GUI agent plans a tap against the screen it observed, but a zero-permission app swaps the foreground to a sensitive target during the reasoning latency, so…https://cpeoples.github.io/dvma/vulnerabilities/detail/handoff_useractivity_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/handoff_useractivity_injection/index.htmlThe receiving app restores state from a Handoff NSUserActivity (userInfo / webpageURL) and TRUSTS it - navigating, mutating state, or acting on an…https://cpeoples.github.io/dvma/vulnerabilities/detail/hardcoded_keys_ivs/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/hardcoded_keys_ivs/index.htmlSymmetric key and IV baked into the binary; IV reused across messages.https://cpeoples.github.io/dvma/vulnerabilities/detail/hardcoded_llm_api_keys/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/hardcoded_llm_api_keys/index.htmlA cloud-LLM API key is shipped in the binary.https://cpeoples.github.io/dvma/vulnerabilities/detail/hidden_context_exposure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/hidden_context_exposure/index.htmlUntrusted retrieved/tool context that should have stayed out of reach (secrets, other users' data) is exposed to the model and the user (successor to…https://cpeoples.github.io/dvma/vulnerabilities/detail/identity_credential_presentation_binding/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/identity_credential_presentation_binding/index.htmlA verifier accepts a digital-identity presentation (mDL/mDoc via Identity Credential / ISO 18013-5, or a Wallet identity assertion) without binding it to THIS…https://cpeoples.github.io/dvma/vulnerabilities/detail/implicit_intent_sensitive_data/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/implicit_intent_sensitive_data/index.htmlSensitive data is placed on an implicit intent (no explicit component/package), so any co-resident app registering a matching filter receives it (Samsung Smart…https://cpeoples.github.io/dvma/vulnerabilities/detail/improper_mac_verification/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/improper_mac_verification/index.htmlA signed token's HMAC is verified with a short-circuiting string equals (==) instead of a constant-time compare, leaking a timing oracle; a companion path…https://cpeoples.github.io/dvma/vulnerabilities/detail/improper_signature_verification/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/improper_signature_verification/index.htmlAn RSA-SHA256 signed update blob is accepted because the app only checks a signature is present and well-formed, never that it binds to the payload; an…https://cpeoples.github.io/dvma/vulnerabilities/detail/inapp_browser_ui_spoofing/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/inapp_browser_ui_spoofing/index.htmlAn in-app WebView browser derives the displayed origin/address-bar from attacker-controllable content instead of the real committed URL, enabling website…https://cpeoples.github.io/dvma/vulnerabilities/detail/incoming_call_metadata_missing_authorization/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/incoming_call_metadata_missing_authorization/index.htmlA provider path returns an incoming call's phone number and associated metadata with no permission check, so a local app reads it with zero grants and no user…https://cpeoples.github.io/dvma/vulnerabilities/detail/prompt_injection_indirect/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/prompt_injection_indirect/index.htmlHidden instructions in scanned QR/image/shared file are executed by the LLM.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_biometric_prompt/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_biometric_prompt/index.htmlLocal auth is event-bound UI only; failure path is trivially bypassed.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_backups/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_backups/index.htmlandroid:allowBackup=true and no iOS backup exclusion leak app data to backups.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_credential_manager/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_credential_manager/index.htmlMisuses the Android Credential Manager / iOS AutoFill: associates credentials with an unverified domain and lets autofill cache secrets into insecure fields.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_firebase_cloud_config/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_firebase_cloud_config/index.htmlA world-readable Firebase/cloud backend URL plus hardcoded cloud credentials expose backend data.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_inter_agent_comms/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_inter_agent_comms/index.htmlMessages between sub-agents are unauthenticated, so a spoofed message misdirects the agent cluster.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_local_storage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_local_storage/index.htmlAuth token and PII written to SharedPreferences/UserDefaults in cleartext.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_ondevice_model_storage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_ondevice_model_storage/index.htmlOn-device model file is unsigned/unencrypted and swappable.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_output_handling/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_output_handling/index.htmlLLM output rendered unsanitized into a WebView / run as a query.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_password_reset_token/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_password_reset_token/index.htmlPassword-reset tokens / magic-login links are short, predictable, and never expire.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_random/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_random/index.htmlUses Random() instead of Random.secure() for tokens/session IDs.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_sdcard_external_storage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_sdcard_external_storage/index.htmlWrites sensitive files to shared/external storage where any app with storage access can read them.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_webview/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_webview/index.htmlWebView exposes a JS bridge and enables file:// access for RCE-style abuse.https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_webview_networking/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/insecure_webview_networking/index.htmlWebView ignores network security config and loads mixed/cleartext content.https://cpeoples.github.io/dvma/vulnerabilities/detail/installed_app_enumeration/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/installed_app_enumeration/index.htmlThe app probes which OTHER apps are installed - iOS canOpenURL over a scheme list, Android queryIntentActivities / getInstalledPackages - with no functional…https://cpeoples.github.io/dvma/vulnerabilities/detail/intent_arg_injection_rce/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/intent_arg_injection_rce/index.htmlAn exported component feeds an attacker-controlled intent extra / command-line arg into an execution path, so another app runs code with this app's privileges…https://cpeoples.github.io/dvma/vulnerabilities/detail/intent_redirection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/intent_redirection/index.htmlAn exported component forwards an attacker-supplied nested intent to an internal component (intent redirection), and lax task affinity enables task hijack.https://cpeoples.github.io/dvma/vulnerabilities/detail/unicode_invisible_prompt_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unicode_invisible_prompt_injection/index.htmlHidden instructions encoded with zero-width / RTL-override characters in scanned or shared text are obeyed by the assistant.https://cpeoples.github.io/dvma/vulnerabilities/detail/ios_capability_composition_chain/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/ios_capability_composition_chain/index.htmlThe vulnerability is the CHAIN, not any one API. A Universal Link resolves to an App Intent -> perform() reads its parameter as a security-scoped file…https://cpeoples.github.io/dvma/vulnerabilities/detail/js_bridge_callback_id_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/js_bridge_callback_id_injection/index.htmlThe native bridge trusts a caller-supplied callbackId and dispatches the result to it without validation, so web content forges an id to invoke a native…https://cpeoples.github.io/dvma/vulnerabilities/detail/js_bridge_exposes_privileged_api/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/js_bridge_exposes_privileged_api/index.htmlA bridge method exposes a privileged native capability (auth-token read, Keychain/Keystore, filesystem, camera/location) to any web content with no origin…https://cpeoples.github.io/dvma/vulnerabilities/detail/jwt_vulnerabilities/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/jwt_vulnerabilities/index.htmlAccepts alg:none tokens and verifies with a weak, guessable secret.https://cpeoples.github.io/dvma/vulnerabilities/detail/keyboard_cache_autofill_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/keyboard_cache_autofill_leakage/index.htmlSensitive text fields allow keyboard caching / autofill of secrets.https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_access_group_authorization_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_access_group_authorization_confusion/index.htmlOver-broad kSecAttrAccessGroup / a shared access group / synchronizable or wrongly-scoped accessibility flags let another app, extension, or user read Keychain…https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_state_integrity_manipulation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_state_integrity_manipulation/index.htmlThe app TRUSTS a Keychain/Keystore item as authoritative but a local attacker can MODIFY that stored state (not merely read it), so tampering with the item…https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_keystore_misuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/keychain_keystore_misuse/index.htmlSecrets stored without hardware-backed protection / with weak accessibility flags.https://cpeoples.github.io/dvma/vulnerabilities/detail/local_security_state_integrity_tampering/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/local_security_state_integrity_tampering/index.htmlA security decision (authenticated?, role, jailbreak-check result, purchase entitlement) is driven by a locally-persisted value in…https://cpeoples.github.io/dvma/vulnerabilities/detail/lockscreen_control_action_authorization/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/lockscreen_control_action_authorization/index.htmlA Control Widget / interactive widget exposed on the Lock Screen, Control Center, or Action Button invokes a sensitive App Intent without the authentication…https://cpeoples.github.io/dvma/vulnerabilities/detail/lock_state_confusion_data_exposure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/lock_state_confusion_data_exposure/index.htmlSensitive data or a privileged action is reachable while the device is LOCKED through an accessibility / notification / widget / VoiceOver path that never…https://cpeoples.github.io/dvma/vulnerabilities/detail/malicious_third_party_sdk/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/malicious_third_party_sdk/index.htmlA bundled SDK exfiltrates data far beyond its stated purpose.https://cpeoples.github.io/dvma/vulnerabilities/detail/malware_detection_absent/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/malware_detection_absent/index.htmlThe app never checks its runtime environment for known-malicious co-resident apps (accessibility abusers, overlay/tapjacking packages, known trojan package…https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_tool_poisoning/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_tool_poisoning/index.htmlA connected tool/MCP server's description carries hidden instructions that the agent ingests and obeys during planning.https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_capability_attestation_absent/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_capability_attestation_absent/index.htmlA connected MCP server self-declares the capabilities (scopes) it holds, and the agent host grants them from the declaration alone with no attestation, so a…https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_open_url_arbitrary_intent/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/mcp_open_url_arbitrary_intent/index.htmlAn MCP tool the agent can invoke (mobile_open_url) maps a model-supplied URL straight to Android startActivity() with no scheme allowlist, so a prompt-injected…https://cpeoples.github.io/dvma/vulnerabilities/detail/mediaprojection_screencapture_authorization_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/mediaprojection_screencapture_authorization_bypass/index.htmlAn attacker-controlled value flows into MediaProjection / screen-capture authorization (a reused/forwarded projection token, a consent-result treated as…https://cpeoples.github.io/dvma/vulnerabilities/detail/sbom_missing_or_stale/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/sbom_missing_or_stale/index.htmlNo Software Bill of Materials is produced, so bundled SDKs and their known-vulnerable versions are invisible to defenders.https://cpeoples.github.io/dvma/vulnerabilities/detail/missing_consent_before_data_access/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/missing_consent_before_data_access/index.htmlAccesses location/contacts/photos with no consent screen.https://cpeoples.github.io/dvma/vulnerabilities/detail/missing_flag_secure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/missing_flag_secure/index.htmlSensitive screen allows screenshots/recording (no FLAG_SECURE).https://cpeoples.github.io/dvma/vulnerabilities/detail/multi_account_isolation_failure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/multi_account_isolation_failure/index.htmlSwitching accounts (or logging out and into account B) does not fully clear account A's cached credentials, tokens, keys, or on-disk/in-memory data, so account…https://cpeoples.github.io/dvma/vulnerabilities/detail/native_code_memory_bugs/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/native_code_memory_bugs/index.htmlA small JNI/FFI routine with a classic unbounded copy (optional/high-effort).https://cpeoples.github.io/dvma/vulnerabilities/detail/no_obfuscation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/no_obfuscation/index.htmlShips with readable symbols; no ProGuard/R8/Dart obfuscation.https://cpeoples.github.io/dvma/vulnerabilities/detail/no_tracking_transparency_prompt/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/no_tracking_transparency_prompt/index.htmlCross-app tracking begins with no ATT-equivalent prompt.https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_alternate_surface_disclosure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_alternate_surface_disclosure/index.htmlSensitive notification content that is redacted on the lock screen is rendered in full on a secondary presentation surface (desktop / DeX mode, widget…https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_listener_authorization_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_listener_authorization_bypass/index.htmlNotification-listener access is effectively granted without a proper user grant - above the lock screen, or via an unverified NotificationListenerService…https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_action_authorization_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_action_authorization_bypass/index.htmlA notification action fires a PendingIntent (or, on Android, trampolines through an exported receiver -> activity) that performs a privileged operation -…https://cpeoples.github.io/dvma/vulnerabilities/detail/oauth_misconfiguration/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/oauth_misconfiguration/index.htmlImplicit-flow access token leaks via redirect URL and logs.https://cpeoples.github.io/dvma/vulnerabilities/detail/ondevice_model_extraction/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/ondevice_model_extraction/index.htmlOn-device model weights are readable/extractable from app storage, enabling model theft and offline attack crafting.https://cpeoples.github.io/dvma/vulnerabilities/detail/ordered_broadcast_result_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/ordered_broadcast_result_injection/index.htmlThe app sends an ordered broadcast and then TRUSTS the aggregated getResultData() / result-extras, but a co-resident receiver registered at a higher priority…https://cpeoples.github.io/dvma/vulnerabilities/detail/photo_picker_over_access/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/photo_picker_over_access/index.htmlRequests full media/photo-library permission instead of the modern scoped photo picker, over-collecting user photos.https://cpeoples.github.io/dvma/vulnerabilities/detail/over_privileged_permissions/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/over_privileged_permissions/index.htmlRequests broad permissions unrelated to app functionality.https://cpeoples.github.io/dvma/vulnerabilities/detail/overlay_phishing/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/overlay_phishing/index.htmlA credential screen can be covered by a look-alike overlay to phish input (no overlay/obscured-touch protection).https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_assertion_replay_signcount/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_assertion_replay_signcount/index.htmlThe authenticator sign-count / credential counter is never persisted or compared, so a captured WebAuthn assertion replays to create additional authenticated…https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_challenge_reuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_challenge_reuse/index.htmlThe server challenge is static / reused / never bound to a single ceremony, so a recorded assertion for one challenge is accepted again (assertion replay via…https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_credential_exfiltration/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_credential_exfiltration/index.htmlPasskey/credential material is cached in app-private storage without hardware-backed protection, allowing extraction.https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_fallback_downgrade/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_fallback_downgrade/index.htmlPasskey auth silently falls back to a weak password/OTP path an attacker can force (authentication downgrade).https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_origin_binding_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_origin_binding_bypass/index.htmlrpId/origin is not properly validated, so a passkey assertion is accepted across origins (relying-party confusion).https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_credential_management_authz/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_credential_management_authz/index.htmlPasskey register/replace/delete endpoints don't re-authorize the acting user, so an attacker can add their own passkey or delete the victim's, causing account…https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_stepup_auth_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_stepup_auth_bypass/index.htmlA sensitive action's 'step-up verified' flag is set from the mere existence of a registered passkey instead of a completed assertion, so step-up is satisfied…https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_user_verification_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_user_verification_bypass/index.htmlA configured userVerification=REQUIRED is silently not enforced, so assertions with the UV flag unset (presence-only) are accepted (Spring Security…https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_weak_attestation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_weak_attestation/index.htmlAccepts WebAuthn/passkey registrations with 'none' attestation and never verifies the authenticator attestation statement.https://cpeoples.github.io/dvma/vulnerabilities/detail/pending_intent_hijacking/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/pending_intent_hijacking/index.htmlMutable, implicit PendingIntent can be intercepted/redirected.https://cpeoples.github.io/dvma/vulnerabilities/detail/pendingintent_provenance_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/pendingintent_provenance_confusion/index.htmlAn SDK/receiver assumes 'who presents a PendingIntent' == 'who created it', so a replayed/forwarded PendingIntent authenticates an attacker as the creating app…https://cpeoples.github.io/dvma/vulnerabilities/detail/persistable_uri_grant_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/persistable_uri_grant_abuse/index.htmlAn exported component receives an attacker-controlled content:// URI carrying FLAG_GRANT_PERSISTABLE_URI_PERMISSION and calls takePersistableUriPermission()…https://cpeoples.github.io/dvma/vulnerabilities/detail/pii_in_analytics_events/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/pii_in_analytics_events/index.htmlRaw PII (email, precise location) sent unfiltered in analytics events.https://cpeoples.github.io/dvma/vulnerabilities/detail/platform_version_security_fallback/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/platform_version_security_fallback/index.htmlA security decision is gated on the OS version (if (SDK_INT >= X) / @available) and silently falls back to an INSECURE path on older versions - e.g. skipping…https://cpeoples.github.io/dvma/vulnerabilities/detail/predictive_back_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/predictive_back_leakage/index.htmlAndroid 14+ predictive-back / recents snapshot captures a sensitive screen because it is not marked secure.https://cpeoples.github.io/dvma/vulnerabilities/detail/privacy_control_alternate_path_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/privacy_control_alternate_path_bypass/index.htmlApp functionality reaches protected data through an ALTERNATE path that sidesteps the platform privacy control (a different API, a shared container / app…https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_input_provider_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_input_provider_injection/index.htmlThe default input-method (IME) surface accepts key/motion events from an untrusted caller because a permission/caller check is missing, so a co-resident app…https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_provider_activation_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_provider_activation_abuse/index.htmlAn app becomes an enabled system provider (accessibility / notification-listener / VPN / IME / device-admin / call-screening / phone-account / MediaProjection…https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_service_binding_exposure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/privileged_service_binding_exposure/index.htmlAn exported/bindable Service exposes a privileged Binder interface (AIDL/Messenger) that any app can bindService() to and call without a caller-identity /…https://cpeoples.github.io/dvma/vulnerabilities/detail/protected_data_access_via_input_validation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/protected_data_access_via_input_validation/index.htmlUntrusted app-supplied input flows through a security-sensitive parser/normalizer whose result is then used to authorize access to a protected resource, so an…https://cpeoples.github.io/dvma/vulnerabilities/detail/provider_metadata_to_filesystem_traversal/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/provider_metadata_to_filesystem_traversal/index.htmlA framework/plugin layer (Flutter/React Native/Cordova/Capacitor) reads DISPLAY_NAME from an UNTRUSTED ContentProvider via ContentResolver.query() and uses it…https://cpeoples.github.io/dvma/vulnerabilities/detail/proximity_transfer_unsafe_parsing/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/proximity_transfer_unsafe_parsing/index.htmlThe app parses an untrusted, pre-authentication proximity-transfer payload (AirDrop / Quick Share plist / XML / archive) with a naive, unbounded parser, so a…https://cpeoples.github.io/dvma/vulnerabilities/detail/push_notification_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/push_notification_leakage/index.htmlSensitive data placed directly in notification payloads / lockscreen.https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_nfc_to_privileged_action/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_nfc_to_privileged_action/index.htmlA scanned QR/NFC tag from an untrusted caller is forwarded straight to a privileged action / automation trigger with no user confirmation, so a co-resident app…https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_code_injection/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_code_injection/index.htmlScanner trusts scanned content and acts on it without validation.https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_url_no_validation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/qr_url_no_validation/index.htmlA scanned QR code's payload is treated as a trusted URL/deeplink and opened/navigated without validation (Firefox iOS QR-scanner CVE-2025-54145 class).https://cpeoples.github.io/dvma/vulnerabilities/detail/rag_vector_store_poisoning/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/rag_vector_store_poisoning/index.htmlA poisoned entry written to the on-device RAG/vector store is retrieved and trusted on later, unrelated queries.https://cpeoples.github.io/dvma/vulnerabilities/detail/root_jailbreak_detection_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/root_jailbreak_detection_bypass/index.htmlDetection result gates on a client-side boolean easily hooked to false.https://cpeoples.github.io/dvma/vulnerabilities/detail/rsa_no_oaep_padding/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/rsa_no_oaep_padding/index.htmlA payload is RSA-encrypted with legacy PKCS#1 v1.5 padding instead of OAEP, exposing it to Bleichenbacher-style chosen-ciphertext padding-oracle attacks; the…https://cpeoples.github.io/dvma/vulnerabilities/detail/screenshot_taskswitcher_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/screenshot_taskswitcher_leakage/index.htmlSensitive screen rendered into the app-switcher snapshot with no FLAG_SECURE.https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_crash_reports/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_crash_reports/index.htmlSecrets, tokens, PII, or full request/response bodies survive into crash / diagnostic reports (Crashlytics/Sentry breadcrumbs, exception messages, attached…https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_logs/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_logs/index.htmlPII, tokens, and passwords printed to system logs.https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_memory/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/sensitive_data_in_memory/index.htmlPasswords/keys are held in long-lived, never-cleared objects, recoverable from a process memory dump.https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_intelligence_ai_processing/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/notification_intelligence_ai_processing/index.htmlSensitive notification content is fed to a privileged notification-intelligence / on-device AI consumer (summary, classification, smart-action) without…https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_session_fixation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_session_fixation/index.htmlThe session identifier is not rotated after a successful passkey assertion, so a pre-set (attacker-known) session id remains valid post-login (session…https://cpeoples.github.io/dvma/vulnerabilities/detail/shared_webview_miniapp_isolation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/shared_webview_miniapp_isolation/index.htmlA super-app hosts multiple mini-programs in ONE shared WebView instance (shared cookie jar / localStorage), so one mini-app reads another mini-app's cookies…https://cpeoples.github.io/dvma/vulnerabilities/detail/shortcuts_path_symlink_sandbox_escape/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/shortcuts_path_symlink_sandbox_escape/index.htmlUntrusted Shortcuts / App Intents input drives a file operation whose path is resolved through a symlink or a ../ traversal with no canonicalization, so the…https://cpeoples.github.io/dvma/vulnerabilities/detail/silent_sdk_auto_update/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/silent_sdk_auto_update/index.htmlA benign-looking SDK silently fetches and swaps in new behavior at runtime (SpinOK-style), turning malicious after install with no app update or review.https://cpeoples.github.io/dvma/vulnerabilities/detail/ssl_pinning_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/ssl_pinning_bypass/index.htmlPinning is implemented but disabled by a client-side flag / easy hook.https://cpeoples.github.io/dvma/vulnerabilities/detail/ssrf_url_media_handler/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/ssrf_url_media_handler/index.htmlAn attacker-controlled URL parameter passed into a fetch/media loader is not restricted to an allowlist, so the app can be steered to internal/loopback…https://cpeoples.github.io/dvma/vulnerabilities/detail/assistant_locked_device_capability_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/assistant_locked_device_capability_abuse/index.htmlThe system assistant surface (Siri / App-Intents / voice shortcuts) exposes sensitive information or performs a privileged capability while the device is…https://cpeoples.github.io/dvma/vulnerabilities/detail/system_prompt_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/system_prompt_leakage/index.htmlSystem prompt (with a fake secret) is extractable via the chat.https://cpeoples.github.io/dvma/vulnerabilities/detail/system_surface_privileged_appintent_exposure/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/system_surface_privileged_appintent_exposure/index.htmlAn App Intent surfaced to many system entry points (Siri, Spotlight, Shortcuts, Widget, Control, Live Activity, Action Button, Apple Intelligence) reaches a…https://cpeoples.github.io/dvma/vulnerabilities/detail/tapjacking/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/tapjacking/index.htmlSensitive action screen does not set filterTouchesWhenObscured.https://cpeoples.github.io/dvma/vulnerabilities/detail/telephony_capability_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/telephony_capability_abuse/index.htmlA loosely-guarded / exported flow lets an untrusted caller drive a telephony capability - place a call, send an SMS, register or manipulate a phone account…https://cpeoples.github.io/dvma/vulnerabilities/detail/temp_file_leftovers/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/temp_file_leftovers/index.htmlDecrypted/sensitive content written to temp/cache dirs and never cleaned up.https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_thirdparty_pairing_authz/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/passkey_thirdparty_pairing_authz/index.htmlThird-party authenticator / cross-device passkey-entry pairing is approved without a permission/authorization check, so an unauthorized app or device is paired…https://cpeoples.github.io/dvma/vulnerabilities/detail/third_party_sdk_data_leakage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/third_party_sdk_data_leakage/index.htmlA stand-in analytics SDK phones home more data than its stated purpose.https://cpeoples.github.io/dvma/vulnerabilities/detail/toctou_race_condition/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/toctou_race_condition/index.htmlAuth is checked then used with a mutable gap an attacker can win.https://cpeoples.github.io/dvma/vulnerabilities/detail/typosquatted_dependency/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/typosquatted_dependency/index.htmlDepends on a lookalike package name mimicking a trusted one.https://cpeoples.github.io/dvma/vulnerabilities/detail/unauthenticated_encryption_malleable_ciphertext/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unauthenticated_encryption_malleable_ciphertext/index.htmlA token is encrypted with AES-CBC and no MAC, so an attacker who never learns the key flips a ciphertext byte to predictably change the decrypted plaintext…https://cpeoples.github.io/dvma/vulnerabilities/detail/unauthenticated_local_loopback_service/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unauthenticated_local_loopback_service/index.htmlThe app opens a local HTTP/TCP or unix-domain socket (for IPC, a debug bridge, a companion SDK, or a WebView bridge) with no authentication, so any co-resident…https://cpeoples.github.io/dvma/vulnerabilities/detail/unbounded_ai_resource_consumption/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unbounded_ai_resource_consumption/index.htmlNo rate limiting on AI calls enables a cost-exhaustion attack.https://cpeoples.github.io/dvma/vulnerabilities/detail/universal_link_aasa_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/universal_link_aasa_confusion/index.htmlThe app trusts an incoming Universal Link because it matched an associated domain, but weak AASA deployment (overly broad path patterns / wildcards, open…https://cpeoples.github.io/dvma/vulnerabilities/detail/unsafe_deserialization/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unsafe_deserialization/index.htmlDeserializes untrusted data into typed objects with no validation.https://cpeoples.github.io/dvma/vulnerabilities/detail/unsafe_media_decoding/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unsafe_media_decoding/index.htmlUntrusted image/media bytes are passed straight to a decoder with no type/size/dimension checks, enabling decompression bombs and codec exploitation (Samsung…https://cpeoples.github.io/dvma/vulnerabilities/detail/unsigned_unverified_build_artifact/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unsigned_unverified_build_artifact/index.htmlUpdate artifact fetched and applied with no signature/checksum check.https://cpeoples.github.io/dvma/vulnerabilities/detail/untrusted_mobile_input_to_llm/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/untrusted_mobile_input_to_llm/index.htmlContent arriving over a mobile trust boundary (deep-link param, clipboard, scanned QR, notification) is concatenated straight into the assistant's prompt…https://cpeoples.github.io/dvma/vulnerabilities/detail/unvalidated_intent_extras/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unvalidated_intent_extras/index.htmlIntent extras trusted as-is, enabling privilege escalation.https://cpeoples.github.io/dvma/vulnerabilities/detail/unverified_model_supply_chain/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/unverified_model_supply_chain/index.htmlModel update fetched from an unauthenticated URL with no checksum.https://cpeoples.github.io/dvma/vulnerabilities/detail/grant_uri_permission_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/grant_uri_permission_abuse/index.htmlA forwarded/redirected Intent carries FLAG_GRANT_READ/WRITE_URI_PERMISSION to a private content:// URI, so a malicious app is transitively granted access to…https://cpeoples.github.io/dvma/vulnerabilities/detail/username_enumeration/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/username_enumeration/index.htmlLogin returns distinguishable responses for valid vs invalid usernames, allowing account enumeration.https://cpeoples.github.io/dvma/vulnerabilities/detail/verbose_error_handling/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/verbose_error_handling/index.htmlError screens render full stack traces and internal details.https://cpeoples.github.io/dvma/vulnerabilities/detail/vpn_provider_trust_anchor_abuse/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/vpn_provider_trust_anchor_abuse/index.htmlAn app that provides a VPN tunnel authenticates the tunnel endpoint weakly - disabled/loose certificate validation, a custom trust manager, user-controllable…https://cpeoples.github.io/dvma/vulnerabilities/detail/vulnerable_dependencies/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/vulnerable_dependencies/index.htmlBundles a library version with a documented known CVE.https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_password_policy/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_password_policy/index.htmlAccepts single-character passwords; no complexity or length checks.https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_tls_config/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_tls_config/index.htmlNegotiates deprecated TLS versions / weak cipher suites.https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_algorithms/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_algorithms/index.htmlMD5/SHA1 for password hashing and DES/RC4/AES-ECB for encryption.https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_key_derivation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_key_derivation/index.htmlDerives keys from passwords with missing or trivial KDF iteration counts.https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_session_management/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/weak_session_management/index.htmlSessions never expire and use predictable, incrementing tokens.https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_cleartext_mixed_content_downgrade/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_cleartext_mixed_content_downgrade/index.htmlA WebView opts out of cleartext blocking (android:usesCleartextTraffic / relaxed network-security-config) and relaxes the Mixed Content Policy…https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_js_injection_ssl_bypass/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_js_injection_ssl_bypass/index.htmlThe WebView disables/relaxes TLS certificate validation (accept-all handler) while also permitting script injection, so a MITM attacker rewrites the loaded…https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_origin_confusion_ipc/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_origin_confusion_ipc/index.htmlThe WebView IPC layer classifies the caller's origin incorrectly, so a remote page is treated as the local/trusted application origin and can invoke…https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_remote_debugging_enabled/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_remote_debugging_enabled/index.htmlWebView.setWebContentsDebuggingEnabled(true) is left on in a production build, so anyone with adb / chrome://inspect access can attach DevTools to the WebView…https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_safe_browsing_disabled/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_safe_browsing_disabled/index.htmlThe WebView disables Google Safe Browsing (android:usesCleartextTraffic aside, EnableSafeBrowsing=false / setSafeBrowsingEnabled(false)), stripping the…https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_sop_csp_disabled/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_sop_csp_disabled/index.htmlThe app's WebView relaxes/omits Same-Origin-Policy and Content-Security-Policy enforcement (e.g. allowUniversalAccessFromFileURLs /…https://cpeoples.github.io/dvma/vulnerabilities/detail/wkwebview_untrusted_url_local_file/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/wkwebview_untrusted_url_local_file/index.htmlUnsanitized user-controlled fields are reflected into a WebView, and file access is left enabled, so injected JS can read the app's local files from the…https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_url_loading_policy_confusion/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/webview_url_loading_policy_confusion/index.htmlThe WebView's URL-policy handler (shouldOverrideUrlLoading / decidePolicyForNavigationAction) makes a trust decision on a raw, un-canonicalized URL, so…https://cpeoples.github.io/dvma/vulnerabilities/detail/zero_click_call_media_parse_sink/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/zero_click_call_media_parse_sink/index.htmlAttacker-controlled call-setup media is parsed while the call is still ringing, before the user accepts, so a declared-length lie drives an out-of-bounds read…https://cpeoples.github.io/dvma/vulnerabilities/detail/zip_path_traversal/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/zip_path_traversal/index.htmlUpdate-package unpacker writes entries outside the target dir.