https://cpeoples.github.io/dvma/vulnerabilities/index.htmlEvery DVMA vulnerability by OWASP MASVS category, mapped to the OWASP Mobile Top 10, MASVS/MASTG, CWE, and the LLM/Agentic Top 10.HugoenThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/storage/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/storage/index.htmlSensitive data persisted without protection: plaintext key-value stores, misused Keychain/Keystore, backup leakage, clipboard, screenshots, logs, keyboard…https://cpeoples.github.io/dvma/vulnerabilities/crypto/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/crypto/index.htmlWeak algorithms, hardcoded keys and static IVs, insecure randomness, trivial key derivation, and homegrown 'encryption'.https://cpeoples.github.io/dvma/vulnerabilities/auth/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/auth/index.htmlSessions that never expire or use predictable tokens, bypassable biometrics, weak password policy, client-side-only authorization, JWT alg:none / weak secrets…https://cpeoples.github.io/dvma/vulnerabilities/network/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/network/index.htmlCleartext traffic, weak TLS, bypassable pinning, accept-all trust managers, and WebViews that ignore network security config.https://cpeoples.github.io/dvma/vulnerabilities/platform/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/platform/index.htmlWebView JS-bridge RCE and file:// access, deep-link/URL-scheme hijack, exported components, content-provider SQLi, pending-intent hijack, tapjacking…https://cpeoples.github.io/dvma/vulnerabilities/code_quality/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/code_quality/index.htmlDebuggable release builds, no obfuscation, verbose error handling that leaks stack traces, a bundled dependency with a known CVE, and an optional native…https://cpeoples.github.io/dvma/vulnerabilities/resilience/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/resilience/index.htmlRoot/jailbreak, anti-debugging, integrity/tamper, emulator, and Frida detection that are all trivially bypassable, plus a TOCTOU race in auth.https://cpeoples.github.io/dvma/vulnerabilities/supply_chain/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/supply_chain/index.htmlA maliciously-behaving bundled SDK, a typosquatted-package scenario, and a build artifact with no signing/integrity verification.https://cpeoples.github.io/dvma/vulnerabilities/privacy/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/privacy/index.htmlData accessed with no consent screen, no tracking-transparency prompt, and PII flowing into analytics unfiltered.https://cpeoples.github.io/dvma/vulnerabilities/input_validation/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/input_validation/index.htmlUnsafe deserialization of untrusted data, and Intent extras trusted without validation leading to privilege escalation.https://cpeoples.github.io/dvma/vulnerabilities/ai_ml/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/ai_ml/index.htmlAn in-app AI assistant demonstrating the OWASP Top 10 for LLM/GenAI, adapted to a mobile client: prompt injection (direct + indirect), insecure output…https://cpeoples.github.io/dvma/vulnerabilities/agentic/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/agentic/index.htmlAn in-app AI *agent* with persistent memory, tool/MCP-style connectors, and sub-agents. Demonstrates the OWASP Top 10 for Agentic AI Applications (2025)…https://cpeoples.github.io/dvma/vulnerabilities/ai_mobile/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/ai_mobile/index.htmlThe emerging crossover surface where an on-device AI assistant meets classic mobile trust boundaries: untrusted mobile input (deep links, clipboard, QR…https://cpeoples.github.io/dvma/vulnerabilities/native_bridge/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/native_bridge/index.htmlThe WebView<->native JavaScript bridge as its own cross-platform trust boundary (Android addJavascriptInterface / WebMessageListener; iOS…https://cpeoples.github.io/dvma/vulnerabilities/system_provider/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/system_provider/index.htmlMobile Capability Broker Abuse: the umbrella surface where an app becomes a privileged system actor/provider and therefore a broker between an untrusted actor…https://cpeoples.github.io/dvma/vulnerabilities/detail/index.htmlThu, 24 Sep 2026 16:36:55 +0000https://cpeoples.github.io/dvma/vulnerabilities/detail/index.htmlPer-vulnerability detail pages.