| Activity-Alias Exposure | activity_alias_exposure | Android | EASY | M4 | MASVS-PLATFORM-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0364 | CWE-926CWE-200CWE-284 |
| Missing FLAG_SECURE (screen recording exposure) | missing_flag_secure | Android | EASY | M4 | MASVS-PLATFORM-3MASVS-STORAGE-2 | MASWE-0038 | MASTG-TEST-0291MASTG-TEST-0293 | CWE-200 |
| Over-Privileged Permissions | over_privileged_permissions | AndroidiOS | EASY | M4 | MASVS-PLATFORM-1MASVS-PRIVACY-2 | MASWE-0066 | MASTG-TEST-0254MASTG-TEST-0255 | CWE-250CWE-272 |
| Over-Broad Media Access (no scoped photo picker) | photo_picker_over_access | AndroidiOS | EASY | M6 | MASVS-PLATFORM-1MASVS-PRIVACY-2 | MASWE-0066 | MASTG-TEST-0254MASTG-TEST-0255 | CWE-250CWE-359 |
| Predictive Back / Recents Snapshot Leakage | predictive_back_leakage | Android | EASY | M9 | MASVS-STORAGE-2MASVS-PLATFORM-3 | MASWE-0038 | MASTG-TEST-0289MASTG-TEST-0292 | CWE-200 |
| Push Notification Leakage | push_notification_leakage | AndroidiOS | EASY | M4 | MASVS-STORAGE-2MASVS-PRIVACY-1 | MASWE-0037 | MASTG-TEST-0315 | CWE-200 |
| QR Scanner -> URL With No Validation | qr_url_no_validation | AndroidiOS | EASY | M4 | MASVS-PLATFORM-3MASVS-CODE-4 | MASWE-0050 | - | CWE-601CWE-20 |
| App Clip Invocation Injection | app_clip_invocation_injection | iOS | MEDIUM | M4 | MASVS-PLATFORM-3MASVS-AUTH-1 | MASWE-0029MASWE-0018 | - | CWE-20CWE-862CWE-501 |
| Background Activity Launch Abuse | background_activity_launch_abuse | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-PLATFORM-3 | MASWE-0032MASWE-0039 | MASTG-TEST-0364 | CWE-862CWE-1021CWE-284 |
| Clipboard Unauthorized Write / Integrity Tampering | clipboard_unauthorized_write_integrity | AndroidiOS | MEDIUM | M4 | MASVS-PLATFORM-2MASVS-CODE-4 | MASWE-0030 | - | CWE-345CWE-471CWE-668 |
| ClipData URI-Grant Leakage | clipdata_uri_grant_leakage | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-STORAGE-2 | MASWE-0032 | MASTG-TEST-0357 | CWE-200CWE-668CWE-927 |
| ContentProvider File-Import Filename Path Traversal | contentprovider_filename_path_traversal | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-STORAGE-2 | MASWE-0032MASWE-0050 | MASTG-TEST-0357 | CWE-22CWE-73CWE-926 |
| Custom / Signature Permission Squatting | custom_signature_permission_squatting | Android | MEDIUM | M4 | MASVS-PLATFORM-1 | MASWE-0018MASWE-0032 | - | CWE-732CWE-280CWE-284 |
| Custom URL Scheme Authorization (arbitrary URL load) | custom_url_scheme_authorization | AndroidiOS | MEDIUM | M4 | MASVS-PLATFORM-3MASVS-CODE-4 | MASWE-0029 | MASTG-TEST-0371MASTG-TEST-0370 | CWE-939CWE-862CWE-601 |
| Deep Link -> Trusted WebView Navigation | deeplink_to_webview_navigation | AndroidiOS | MEDIUM | M4 | MASVS-PLATFORM-2MASVS-PLATFORM-1 | MASWE-0035MASWE-0029 | MASTG-TEST-0332MASTG-TEST-0027 | CWE-939CWE-601CWE-749 |
| Deep Link / URL Scheme Hijack | deeplink_url_scheme_hijack | AndroidiOS | MEDIUM | M4 | MASVS-PLATFORM-1 | MASWE-0029 | MASTG-TEST-0028MASTG-TEST-0393MASTG-TEST-0371 | CWE-939CWE-20 |
| Default-Role / Role-Holder Confusion | default_role_holder_confusion | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0032MASWE-0018 | - | CWE-346CWE-940CWE-284 |
| Document Picker -> Trusted-File Confusion | document_picker_trusted_file_confusion | iOS | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-CODE-4 | MASWE-0050 | - | CWE-20CWE-829CWE-73 |
| Dynamic BroadcastReceiver Exposure | dynamic_broadcast_receiver_exposure | Android | MEDIUM | M4 | MASVS-PLATFORM-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0366 | CWE-925CWE-926CWE-200 |
| Exported Android Components | exported_android_components | Android | MEDIUM | M4 | MASVS-PLATFORM-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0364MASTG-TEST-0365MASTG-TEST-0366 | CWE-926CWE-284 |
| Exported Component -> Arbitrary URL / Activity Launch | exported_component_arbitrary_url_activity | Android | MEDIUM | M4 | MASVS-PLATFORM-1 | MASWE-0032 | MASTG-TEST-0364 | CWE-926CWE-749CWE-601 |
| Exported Component -> Unauthorized State Manipulation | exported_component_state_manipulation | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0364 | CWE-862CWE-639CWE-284 |
| Handoff / NSUserActivity Injection | handoff_useractivity_injection | iOS | MEDIUM | M4 | MASVS-PLATFORM-3MASVS-CODE-4 | MASWE-0050 | - | CWE-20CWE-345CWE-501 |
| Implicit Intent Leaks Sensitive Data | implicit_intent_sensitive_data | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-STORAGE-2 | MASWE-0032 | MASTG-TEST-0374MASTG-TEST-0372 | CWE-927CWE-200 |
| In-App Browser UI / Address-Bar Spoofing | inapp_browser_ui_spoofing | AndroidiOS | MEDIUM | M4 | MASVS-PLATFORM-2 | MASWE-0035 | - | CWE-1021CWE-451 |
| Incoming-Call Metadata Read (Missing Authorization class) | incoming_call_metadata_missing_authorization | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-PRIVACY-1 | MASWE-0032 | - | CWE-862CWE-200 |
| Notification-Action / Trampoline Authorization Bypass | notification_action_authorization_bypass | AndroidiOS | MEDIUM | M4 | MASVS-AUTH-1MASVS-PLATFORM-1 | MASWE-0018MASWE-0032 | MASTG-TEST-0381 | CWE-862CWE-306CWE-863 |
| Notification Listener Authorization Bypass | notification_listener_authorization_bypass | Android | MEDIUM | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0018 | - | CWE-862CWE-284CWE-306 |
| Ordered-Broadcast Result Injection | ordered_broadcast_result_injection | Android | MEDIUM | M4 | MASVS-PLATFORM-1 | MASWE-0032 | MASTG-TEST-0366 | CWE-925CWE-349CWE-348 |
| Overlay Phishing | overlay_phishing | Android | MEDIUM | M4 | MASVS-PLATFORM-3 | MASWE-0039 | MASTG-TEST-0035MASTG-TEST-0340 | CWE-1021CWE-290 |
| Platform-Version Security Fallback | platform_version_security_fallback | AndroidiOS | MEDIUM | M8 | MASVS-PLATFORM-1MASVS-CODE-4 | MASWE-0041 | MASTG-TEST-0245 | CWE-636CWE-1188CWE-693 |
| QR Code Injection | qr_code_injection | AndroidiOS | MEDIUM | M4 | MASVS-CODE-4 | MASWE-0050 | - | CWE-20 |
| SSRF via URL / Media Handler | ssrf_url_media_handler | AndroidiOS | MEDIUM | M4 | MASVS-NETWORK-1MASVS-PLATFORM-3 | MASWE-0050 | - | CWE-918CWE-601 |
| Tapjacking | tapjacking | Android | MEDIUM | M4 | MASVS-PLATFORM-3 | MASWE-0039 | MASTG-TEST-0035MASTG-TEST-0340 | CWE-1021 |
| AccessibilityService Privilege Abuse | accessibility_service_privilege_abuse | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0040 | - | CWE-862CWE-284CWE-441 |
| Activity Task-Stack / Affinity Hijacking | activity_task_stack_hijacking | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-PLATFORM-3 | MASWE-0032 | - | CWE-1021CWE-451CWE-346 |
| Android Capability-Composition Chain | android_capability_composition_chain | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0032MASWE-0018 | - | CWE-441CWE-862CWE-668 |
| App Intent / Siri Parameter -> Privileged Action (No Authz) | app_intent_parameter_authorization | iOS | HARD | M4 | MASVS-PLATFORM-3MASVS-AUTH-1 | MASWE-0018 | - | CWE-862CWE-639CWE-20 |
| Authorization Based on Mutable Resource State | authorization_by_mutable_resource_state | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0018 | - | CWE-367CWE-708CWE-863 |
| Clipboard -> Privileged Action Injection | clipboard_to_privileged_action_injection | AndroidiOS | HARD | M4 | MASVS-PLATFORM-2MASVS-CODE-4 | MASWE-0030 | - | CWE-20CWE-77CWE-441 |
| Confused-Deputy Intent Validation Bypass | confused_deputy_intent_validation | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0364 | CWE-441CWE-863CWE-862 |
| Blind SQLi Boolean-Oracle Extraction (Contacts-Provider class) | contacts_provider_blind_sqli_oracle | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-CODE-4 | MASWE-0032 | - | CWE-89CWE-862 |
| Content Provider SQL Injection | content_provider_sql_injection | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-CODE-4 | MASWE-0018MASWE-0050 | MASTG-TEST-0339MASTG-TEST-0355 | CWE-89 |
| content:// URI -> ContentResolver Confused Deputy | content_uri_resolver_confused_deputy | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0355 | CWE-441CWE-862CWE-639 |
| Cross-App Scripting (Untrusted Intent -> Exported Activity -> WebView JS) | cross_app_scripting | Android | HARD | M4 | MASVS-PLATFORM-2MASVS-CODE-4 | MASWE-0035MASWE-0032 | MASTG-TEST-0332MASTG-TEST-0031 | CWE-79CWE-749CWE-940 |
| Cross-Profile (Work/Personal) Data & Capability Leakage | cross_profile_data_capability_leakage | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-STORAGE-1 | MASWE-0032 | - | CWE-200CWE-668CWE-863 |
| Dynamic Code Loading (Arbitrary Code Execution) | dynamic_code_loading_rce | AndroidiOS | HARD | M4 | MASVS-CODE-4MASVS-RESILIENCE-3 | MASWE-0049 | - | CWE-494CWE-829 |
| File-Descriptor Capability Leakage | file_descriptor_capability_leakage | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-STORAGE-2 | MASWE-0032MASWE-0018 | - | CWE-402CWE-668CWE-200 |
| FileProvider Path Traversal / Arbitrary File Sharing | fileprovider_path_traversal | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-STORAGE-1 | MASWE-0032 | MASTG-TEST-0357 | CWE-22CWE-926 |
| URI Permission / GRANT_URI_PERMISSIONS Abuse | grant_uri_permission_abuse | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-STORAGE-2 | MASWE-0032 | MASTG-TEST-0357 | CWE-266CWE-668CWE-927 |
| Insecure WebView (JS Bridge RCE, file:// access) | insecure_webview | AndroidiOS | HARD | M4 | MASVS-PLATFORM-2 | MASWE-0033MASWE-0034 | MASTG-TEST-0334MASTG-TEST-0333MASTG-TEST-0250 | CWE-749CWE-79 |
| Intent Argument Injection -> Local Code Execution | intent_arg_injection_rce | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-CODE-4 | MASWE-0032 | - | CWE-88CWE-829CWE-94 |
| Intent Redirection / Task Hijack (StrandHogg-style) | intent_redirection | Android | HARD | M4 | MASVS-PLATFORM-1 | MASWE-0032 | MASTG-TEST-0375 | CWE-926CWE-940 |
| iOS Capability-Composition Chain | ios_capability_composition_chain | iOS | HARD | M4 | MASVS-PLATFORM-3MASVS-AUTH-1 | MASWE-0029MASWE-0018 | - | CWE-441CWE-862CWE-668 |
| Pending Intent Hijacking | pending_intent_hijacking | Android | HARD | M4 | MASVS-PLATFORM-1 | MASWE-0032 | MASTG-TEST-0381MASTG-TEST-0030 | CWE-927 |
| PendingIntent Provenance Confusion | pendingintent_provenance_confusion | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0381 | CWE-441CWE-290CWE-923 |
| Persistent URI-Grant Capability Abuse | persistable_uri_grant_abuse | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-STORAGE-2 | MASWE-0032 | MASTG-TEST-0357 | CWE-284CWE-266CWE-668 |
| Privileged Service Binding / Binder Interface Exposure | privileged_service_binding_exposure | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0018MASWE-0032 | MASTG-TEST-0365 | CWE-284CWE-749CWE-862 |
| Proximity Transfer Unsafe Parsing (AirDrop / Quick Share) | proximity_transfer_unsafe_parsing | AndroidiOS | HARD | M4 | MASVS-PLATFORM-2MASVS-CODE-4 | MASWE-0050 | - | CWE-776CWE-674CWE-20 |
| App-Widget / RemoteViews Action Injection | remoteviews_widget_action_injection | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0381 | CWE-926CWE-862CWE-863 |
| Shortcuts / App Intents Path + Symlink Sandbox Escape | shortcuts_path_symlink_sandbox_escape | iOS | HARD | M4 | MASVS-STORAGE-2MASVS-PLATFORM-3 | MASWE-0050 | - | CWE-59CWE-22CWE-367 |
| System-Surface -> Privileged App Intent Exposure | system_surface_privileged_appintent_exposure | iOS | HARD | M4 | MASVS-PLATFORM-3MASVS-AUTH-1 | MASWE-0018 | MASTG-TEST-0362 | CWE-862CWE-284CWE-267 |
| Telephony / Phone-Account Capability Abuse | telephony_capability_abuse | Android | HARD | M4 | MASVS-PLATFORM-1MASVS-AUTH-1 | MASWE-0032MASWE-0018 | MASTG-TEST-0365 | CWE-862CWE-284CWE-441 |
| Unauthenticated Local / Loopback Service | unauthenticated_local_loopback_service | AndroidiOS | HARD | M4 | MASVS-NETWORK-1MASVS-PLATFORM-1 | MASWE-0018 | - | CWE-306CWE-668CWE-350 |
| Universal Link / AASA Associated-Domain Confusion | universal_link_aasa_confusion | iOS | HARD | M4 | MASVS-PLATFORM-3MASVS-CODE-4 | MASWE-0029 | MASTG-TEST-0395MASTG-TEST-0070 | CWE-939CWE-20CWE-601 |
| WebView Untrusted URL -> Local File Read (iOS WKWebView) | wkwebview_untrusted_url_local_file | iOS | HARD | M4 | MASVS-PLATFORM-2MASVS-STORAGE-2 | MASWE-0034MASWE-0035 | MASTG-TEST-0333MASTG-TEST-0332 | CWE-79CWE-73CWE-200 |
| Zero-Click Media Parse Before User Accept (VoIP-ring class) | zero_click_call_media_parse_sink | AndroidiOS | HARD | M7 | MASVS-CODE-4MASVS-PLATFORM-3 | MASWE-0050 | - | CWE-20CWE-125 |
| Zip Path Traversal (Zip-Slip) | zip_path_traversal | AndroidiOS | HARD | M4 | MASVS-CODE-4MASVS-STORAGE-1 | MASWE-0050 | - | CWE-22 |