Privileged System-Provider Activation

Mobile Capability Broker Abuse: the umbrella surface where an app becomes a privileged system actor/provider and therefore a broker between an untrusted actor and a privileged system capability (accessibility, notification listener / notification-intelligence, input method, VPN, credential provider, phone account, call screening, MediaProjection, device policy / MDM, companion device, Assist / screen-context, App Intent, widget / control, app extension, file provider). Five distinct ways to attack the broker: (1) activation abuse - tapjack/overlay the user or system into enabling it; (2) input injection - feed malicious data into it; (3) authorization confusion - make it act for the wrong principal; (4) capability leakage - expose what the broker can see/do; (5) cross-boundary confusion - work<->personal, app<->extension, device<->companion, user<->AI. Modelled on 2023-2026 disclosures: MediaProjection screen-capture authorization bypass (CVE-2025-32322), tapjacking-to-enable a malicious phone account (CVE-2023-20913), IME key/motion-event injection (CVE-2025-26450), DevicePolicyManagerService logic flaw (CVE-2025-48553), and VPN-agent certificate-validation MITM (CVE-2026-0248).

12 vulnerabilities. OWASP Mobile: M4

VulnerabilityIDPlatformDifficultyOWASPMASVSMASWEMASTG (v2)CWE
App Group Shared-Container Privilege Amplificationapp_group_shared_container_amplificationiOSMEDIUMM9MASVS-STORAGE-1MASVS-PLATFORM-1MASWE-0002MASTG-TEST-0388CWE-200CWE-732CWE-668
Assist / Screen-Context -> AI Action Exposureassist_screen_context_ai_exposureAndroidMEDIUMM6MASVS-PLATFORM-1MASVS-PRIVACY-1MASWE-0036-CWE-200CWE-668CWE-863
Companion Device Pairing / Capability Confusioncompanion_device_pairing_confusionAndroidMEDIUMM4MASVS-PLATFORM-1MASVS-AUTH-1MASWE-0018-CWE-863CWE-284CWE-1188
Custom Keyboard / IME Input Interceptioncustom_keyboard_input_interceptionAndroidMEDIUMM4MASVS-PLATFORM-1MASVS-PRIVACY-1MASWE-0040MASTG-TEST-0390CWE-200CWE-359CWE-522
App Extension Activation != Input Authorizationextension_activation_input_confusioniOSMEDIUMM4MASVS-PLATFORM-1MASVS-CODE-4MASWE-0031MASTG-TEST-0072CWE-20CWE-345CWE-441
Lock-Screen Control / Widget Action Authorizationlockscreen_control_action_authorizationiOSMEDIUMM4MASVS-AUTH-1MASVS-PLATFORM-1MASWE-0018-CWE-862CWE-284CWE-863
Sensitive Notification -> Privileged AI Processingnotification_intelligence_ai_processingAndroidMEDIUMM6MASVS-PLATFORM-1MASVS-PRIVACY-1MASWE-0037-CWE-200CWE-79CWE-1230
Device Policy / MDM Capability Abusedevice_policy_mdm_capability_abuseAndroidHARDM4MASVS-PLATFORM-1MASVS-AUTH-1MASWE-0018-CWE-862CWE-269CWE-841
MediaProjection / Screen-Capture Authorization Bypassmediaprojection_screencapture_authorization_bypassAndroidHARDM4MASVS-PLATFORM-1MASVS-PRIVACY-1MASWE-0038-CWE-20CWE-862CWE-200
Privileged Input-Provider (IME) Event Injectionprivileged_input_provider_injectionAndroidHARDM4MASVS-PLATFORM-1MASVS-AUTH-1MASWE-0018-CWE-862CWE-284CWE-863
Privileged Provider Activation Abuseprivileged_provider_activation_abuseAndroidHARDM4MASVS-PLATFORM-1MASVS-AUTH-1MASWE-0018-CWE-1021CWE-862CWE-441
VPN Provider Trust-Anchor / Tunnel MITMvpn_provider_trust_anchor_abuseAndroidiOSHARDM5MASVS-NETWORK-1MASVS-NETWORK-2MASWE-0027MASTG-TEST-0282CWE-295CWE-297CWE-940