appsec.fyi

Mobile Security Resources

Post Share

A curated AppSec resource library covering XSS, SQLi, SSRF, IDOR, RCE, XXE, OSINT, and more.

Mobile Security

Mobile application security encompasses the unique attack surface of iOS and Android applications, including insecure local data storage, weak transport layer protection, insufficient binary protections, and client-side injection vulnerabilities. The OWASP Mobile Top 10 highlights risks such as improper platform usage, insecure data storage, insecure communication, insecure authentication, insufficient cryptography, and code tampering. Mobile apps face threats that web applications do not: reverse engineering of client-side code, certificate pinning bypass, inter-process communication attacks, and exploitation of platform-specific features like deep links, content providers, and keychain storage. Tools like Frida, objection, MobSF, and Jadx enable dynamic instrumentation and static analysis of mobile binaries, while proxy tools allow interception of API traffic for server-side testing.

Date Added Link Excerpt
2026-05-06 NEW 2026Critical Android vulnerability CVE-2026-0073 fixed by Google news RCEReference to CVE-2026-0073, a critical remote code execution flaw in Android's System component affecting the Android Debug Bridge daemon (adbd). This vulnerability, patched by Google, allowed attackers to execute code as the shell user without privileges or user interaction. While not publicly exploited, it underscores ongoing security risks, similar to the previously exploited Qualcomm component vulnerability, CVE-2026-21385. → securityaffairs.com
2026-05-06 NEW 2026Critical Remote Code Execution Vulnerability Patched in Android news RCELibrary for patching CVE-2026-0073, a critical remote code execution flaw in the Android System component. This vulnerability in the Android Debug Bridge daemon allows exploitation without user interaction to execute code as the shell user. Google has released an update addressing this issue, noting no observed exploitation.
2026-05-05 NEW 2026Google Update: Android Flaw Could Put Billions of Devices at Risk news RCEGoogle Update: Android Flaw Could Put Billions of Devices at Risk https://ift.tt/hVIfD24
2026-05-05 NEW 2026Critical Qualcomm Chipset Vulnerabilities Enables Remote Code Execution news RCEResearchers discovered critical vulnerabilities in Qualcomm chipsets that could allow remote code execution. These flaws, detailed in a linked report, pose a significant security risk by potentially enabling attackers to control devices without user interaction. The specific details of the vulnerabilities and their exploitation potential are highlighted, emphasizing the widespread impact given Qualcomm's prevalence in mobile devices. The summary does not mention a specific bug bounty payout amount as none was provided in the content. → cybersecuritynews.com
2026-05-05 NEW 2026Android Zero-Click RCE Vulnerability Enables Remote Shell Access news RCETool. This resource details CVE-2026-0073, a zero-click RCE vulnerability in Android's Debug Bridge daemon (adbd) affecting multiple OS versions, including Android 14-16. Exploitable from the same local network or physical proximity, it allows remote shell access without user interaction or elevated privileges, bypassing application sandboxing and potentially enabling persistence. Recommendations include timely patching, disabling USB debugging, restricting ADB access, network segmentation, and implementing zero trust policies. → esecurityplanet.com
2026-05-05 NEW 2026Google Confirms Critical Android 0-Click VulnerabilityUpdate Now news RCEGoogle Confirms Critical Android 0-Click Vulnerability—Update Now https://ift.tt/r9c8NaL
2026-05-05 NEW 2026Critical Android Zero-Click Vulnerability Grants Attackers Remote Shell Access news RCEA critical zero-click vulnerability in Android allows attackers to gain remote shell access to devices. This means attackers can compromise a device without any user interaction, making it a severe threat. The vulnerability has been patched by Google. No specific bounty payout amount is mentioned in the provided text. → cyberpress.org
2026-05-05 NEW 2026Critical Remote Code Execution Vulnerability Patched in Android news RCEVulnerability writeup detailing CVE-2026-0073, a critical remote code execution flaw in Android's System component affecting the Android Debug Bridge daemon ('adbd'). Exploitation allows an unauthenticated attacker to execute code as the shell user without requiring user interaction. The report notes this vulnerability has not been observed in the wild, unlike several other Android flaws from previous years such as CVE-2024-43093 and CVE‑2025‑27038. → securityweek.com
2026-05-05 NEW 2026Critical Qualcomm Chip Flaws Could Allow Remote Code Execution Attacks news RCECritical vulnerabilities have been discovered in Qualcomm chips, potentially enabling remote code execution (RCE) attacks. These flaws, if exploited, could allow attackers to gain control of devices without user interaction. The security bulletin highlights the severity of these vulnerabilities, which could impact a wide range of devices relying on Qualcomm's processing power. No specific bounty payout amount was mentioned in the provided content. → cyberpress.org
2026-05-05 NEW 2026Qualcomm Chipset Vulnerabilities Raise Alarm Over Remote Code Execution Risk news RCEQualcomm chipsets are facing a serious security threat from newly discovered vulnerabilities. These flaws could allow attackers to execute malicious code remotely on affected devices, potentially leading to widespread compromise. The extent of the impact is still being assessed, but the risk of remote code execution is a significant concern for the millions of devices relying on Qualcomm technology. Further details on specific CVEs and affected models are expected to be released as the investigation continues. → gbhackers.com
2026-05-05 NEW 2026Critical Android Zero-Click Vulnerability Enables Remote Shell Access news RCEA critical zero-click vulnerability has been discovered in Android, allowing attackers to gain remote shell access to a device without any user interaction. This means a device can be compromised simply by being targeted, without the user needing to click a link or open a file. The severity of this vulnerability is extremely high, as it bypasses typical security measures and opens devices up to potential data theft and malicious control. Further details are available at the provided link. → gbhackers.com
2026-05-05 NEW 2026Critical Android Zero-Click Vulnerability Grants Remote Shell Access news RCECritical Android Zero-Click Vulnerability Grants Remote Shell Access https://ift.tt/WMdoOBe → cybersecuritynews.com
2026-05-04 2026Weekly Recap: AI-Powered Phishing Android Spying Tool Linux Exploit GitHub RCE & More news AI RCELibrary for securing applications, this resource details ongoing threats and vulnerabilities. Key issues include active exploitation of a cPanel flaw (CVE-2026-41940) leading to authentication bypass and data wiping, and a Linux kernel vulnerability (CVE-2026-31431) enabling trivial privilege escalation. It also covers supply chain attacks via npm, PyPI, and Packagist by TeamPCP, a Python backdoor framework (DEEP#DOOR) for data theft and system manipulation, a critical GitHub flaw (CVE-2026-3854) allowing remote code execution, and the VECT 2.0 ransomware's destructive encryption method. → thehackernews.com
2026-05-01 2026Spyware-as-a-Service Platform Enables Rebranding and Resale Of Android Malware beginnerA new Spyware-as-a-Service (SPaaS) platform has emerged, allowing threat actors to rebrand and resell sophisticated Android malware. This "malware factory" empowers less technical criminals to deploy customized spyware, making it harder to track and attribute attacks. The platform likely lowers the barrier to entry for developing and distributing mobile surveillance tools, posing a significant threat to Android users worldwide. → cyberpress.org
2026-04-29 202638 Vulnerabilities Found in OpenEMR Medical Software news SQLiAnalysis of 38 vulnerabilities in OpenEMR, including critical SQL injection flaws (CVE-2026-24908, CVE-2026-23627) and authorization bypasses (CVE-2026-24487), reveals risks of PHI exfiltration and remote code execution. These patched issues, primarily stemming from authorization defects, were discovered by Aisle. → securityweek.com
2026-04-22 2026Root/Jailbreak Detection and SSL Pinning in KMM intermediateLibrary implementing root/jailbreak detection and SSL pinning for Kotlin Multiplatform Mobile (KMM) applications. It details platform-specific techniques for detecting rooted Android devices by checking for the `su` binary or common root packages, and for jailbroken iOS devices by looking for Cydia or writable system directories. The library also covers SSL pinning using OkHttpClient on Android and a custom URLSessionDelegate with proxy detection on iOS to prevent man-in-the-middle attacks. The article further explores how attackers bypass these protections, particularly using Frida for dynamic instrumentation.
2026-04-22 2026Reversing Android Apps: Bypassing Detection Like a Pro intermediateLibrary for bypassing common Android app detection mechanisms like Frida, root checks, and SSL pinning. Techniques include utilizing Magisk DenyList, employing Frida codeshare scripts, attaching Frida after app launch, static analysis with Jadx to identify and patch detection code, using Objection's `patchapk` feature, dumping loaded classes, tracing method calls, reversing native JNI code, and patching SSL pinning with `apk-mitm` for network traffic analysis.
2026-04-22 2026Reverse engineering and modifying Android apps with JADX and Frida intermediateLibrary for reverse engineering and modifying Android applications, utilizing JADX for code extraction and Frida for dynamic instrumentation. This resource details how to decompile APKs, analyze Java source code generated by JADX, and write custom Frida scripts to bypass security measures like certificate pinning, enabling traffic interception with tools like HTTP Toolkit. It covers techniques applicable to understanding and altering app behavior beyond standard certificate pinning implementations.
2026-04-22 2026Common Vulnerabilities and Exposures Examples in Mobile Apps beginnerLibrary for validating mobile application CVEs, enabling security teams to reproduce exploits and analyze vulnerabilities in virtualized iOS and Android environments. It supports automated security assessments, real-time reporting, and tools like Frida for hooking and tracing behavior, addressing challenges posed by the rising volume of CVEs and the limitations of testing within app sandboxes. This approach moves beyond static CVE database entries to provide actionable insights into exploitable risks, exemplified by issues like CVE-2024-26131 in the Element Android App and the Operation Triangulation CVE chain impacting iOS.
2026-04-22 2026Bypassing iOS Frida Detection with LLDB and Frida intermediateWriteup details bypassing iOS Frida detection using LLDB and Frida. The process involves jailbreaking an iPhone, setting up development tools like `libimobiledevice`, `frida-tools`, and LLDB, and then using `debugserver` for remote debugging. The author demonstrates how to find and breakpoint `FridaInTheMiddle.systemSanityCheck()` with LLDB to bypass detection, trace the `dummyFunction(flag:)` Swift function using `frida-trace` to get its mangled name, and finally hook this function with a Frida script to intercept and decode the Swift string argument, ultimately revealing the flag.
2026-04-22 2026frida-interception-and-unpinning: Scripts to MitM all HTTPS traffic intermediateLibrary of Frida scripts automates HTTPS MitM interception on mobile devices by redirecting traffic to a proxy, injecting CA certificates into trust stores, and patching certificate pinning and transparency checks. It also handles fallback patching for obfuscated certificate pinning on Android, disables root/jailbreak detection, and blocks HTTP/3 connections. The scripts can be used independently or together to intercept HTTP(S) traffic on Android and iOS.
2026-04-22 2026Android Reports and Resources beginnerLibrary of Android security reports and resources detailing vulnerabilities such as CVE-2020-8913 in the Google Play Core library, path traversal, account takeover via deep links, sensitive information disclosure, arbitrary code execution in TikTok, memory corruption exploitation, SQL injection in Content Providers, and XSS via WebView. It includes resources on secure cryptography, WebResourceResponse configurations, and vendor-specific issues in Xiaomi and Samsung devices, alongside references to vulnerable Android applications like Oversecured, GoatDroid, and Sieve for educational purposes.
2026-04-22 2026iOS Security Testing - OWASP MASTG beginnerLibrary for iOS security testing, detailing environment setup with macOS hosts, jailbroken devices, and tools like Burp Suite or OWASP ZAP. It covers obtaining device UDIDs via Finder or command-line tools such as `idevice_id` and `instruments`, and contrasts iOS simulators with emulators, noting the simulator's limitations for reverse engineering. The library also explains jailbreaking concepts, contrasting them with Android rooting, and highlights the benefits of privileged access for security testers, including root file system access and unrestricted debugging. It further categorizes jailbreak types (tethered, semi-tethered, semi-untethered, untethered) and discusses the challenges of maintaining jailbroken devices due to Apple's security hardening and signing mechanisms, mentioning exploits like CVE-2015-6794 and CVE-2015-7037. → mas.owasp.org
2026-04-22 2026Android Security Bulletin - March 2026 newsBulletin detailing security vulnerabilities affecting Android devices, including critical remote code execution flaws in the System component. Patches are available for security patch levels 2026-03-01 and 2026-03-05, addressing issues in Framework, System, Kernel, and various vendor components like Arm, MediaTek, Unisoc, and Qualcomm. Android and Google Play Protect mitigations are discussed to enhance device security.
2026-04-22 2026Android Security Bulletin - April 2026 newsBulletin detailing critical vulnerabilities in Android Framework, potentially leading to local denial of service without requiring user interaction or execution privileges. It addresses issues with security patch levels 2026-04-01 and 2026-04-05, affecting components from Google, NXP, STMicroelectronics, and Thales. The document also covers Android and Google Play Protect mitigations, emphasizing the importance of updating to the latest Android versions.
2026-04-19 2026Zero-Day Vulnerabilities in Apple WebKit — CSA Singapore newsZero-Day Vulnerabilities in Apple WebKit — CSA Singapore
2026-04-19 2026Update Apple Devices: Actively Exploited CVE-2025-14174 & CVE-2025-43529 newsWriteup of CVE-2025-14174 and CVE-2025-43529, actively exploited WebKit vulnerabilities in Apple devices. CVE-2025-14174, an out-of-bounds memory access flaw in ANGLE for Chrome on Mac, and CVE-2025-43529, a WebKit vulnerability, may have been used in tandem to execute arbitrary code via crafted HTML pages. Both have been addressed in recent iOS, macOS, tvOS, watchOS, visionOS, and Safari updates, and CVE-2025-43529 is now on CISA's Known Exploited Vulnerabilities catalog. → helpnetsecurity.com
2026-04-19 2026CVE-2025-14174: Apple WebKit Memory Corruption Zero-Day newsWriteup on CVE-2025-14174, a WebKit memory corruption zero-day actively exploited in targeted attacks. This vulnerability, alongside CVE-2025-43529, impacts all Apple devices rendering web content, including Safari and iOS/iPadOS browsers, allowing for arbitrary code execution through malicious web pages. Google also patched a similar out-of-bounds memory access issue in ANGLE. Immediate OS and browser updates are critical mitigation measures, as these exploits highlight the growing risk of browser engine vulnerabilities.
2026-04-19 2026Two Serious Vulnerabilities in Latest Android Security Update newsTwo Serious Vulnerabilities in Latest Android Security Update
2026-04-19 2026LANDFALL: New Commercial-Grade Android Spyware (CVE-2025-21042) newsAnalysis of LANDFALL, a commercial-grade Android spyware targeting Samsung Galaxy devices, details its exploitation of CVE-2025-21042, a zero-day vulnerability in Samsung’s image processing library. Delivered via malicious DNG image files, potentially through WhatsApp, LANDFALL facilitates comprehensive surveillance. This operation, active since mid-2024 and patched in April 2025, predates public disclosures of similar exploit chains involving CVE-2025-21043 and iOS vulnerabilities, suggesting links to private-sector offensive actors in the Middle East. → unit42.paloaltonetworks.com
2026-04-16 2026Awesome Android Reverse Engineering: Curated List beginnerLibrary of curated training, tools, and resources for Android reverse engineering, covering static and dynamic analysis techniques, decompilation with JADX and Ghidra, dynamic instrumentation with Frida and Objection, network analysis using Burp Suite and Wireshark, and popular tools like MobSF, QARK, and Androguard. It also lists resources for obfuscation, anti-reversing, firmware analysis, and includes CTFs and crackmes for hands-on practice.
2026-04-16 2026Android App Reverse Engineering 101 beginnerWorkshop slides introduce static analysis techniques for reverse engineering Android applications, focusing on understanding code without execution. Exercises are performed within a provided Ubuntu 18.04 VM pre-loaded with necessary tools, with a username of "AndroidAppRE" and password "android." This resource builds foundational skills applicable to areas like Android malware analysis and vulnerability hunting.
2026-04-16 2026Exploiting Android Fingerprint Authentication intermediateExploiting Android Fingerprint Authentication
2026-04-16 2026Android Keystore Pitfalls and Best Practices intermediateLibrary detailing Android Keystore pitfalls, this resource examines the complexities of mobile biometric authentication within the Android ecosystem. It highlights how half of tested Android apps fail OWASP AUTH-2 standards and how many fingerprint authentications can be bypassed. Best practices are discussed, emphasizing the importance of `UserAuthenticationRequired` for cryptographic keys and proper utilization of `CryptoObject` for secure data encryption/decryption, contrasting with insecure event-based or non-cryptographic implementations.
2026-04-16 2026Frida's Impact on Mobile Security and How to Fight Back intermediateFrida's Impact on Mobile Security and How to Fight Back
2026-04-16 2026From an Android Hook to RCE: $5000 Bounty intermediateFrom an Android Hook to RCE: $5000 Bounty
2026-04-16 2026iOS Reverse Engineering: Defeating Anti-Debug and Extracting Hidden Flag intermediateWalkthrough of bypassing anti-debug and anti-Frida mechanisms in an iOS application to extract a hidden flag. This process involves static analysis using `rabin2` to find relevant strings, dynamic analysis with `FridaGadget` embedded via `insert_dylib`, and runtime instrumentation with a custom Frida script. The technique leverages `TrollStore` for installation and `FridaGadget.dylib` to bypass runtime detection and hook `UILabel` updates, ultimately revealing the flag.
2026-04-16 2026DarkSword iOS Exploit Chain Adopted by Multiple Threat Actors - Google newsLibrary for detecting and analyzing the DarkSword iOS exploit chain, which leverages multiple zero-day vulnerabilities to compromise devices. It details its use by various threat actors, including UNC6748, against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. The library identifies specific vulnerabilities like CVE-2025-31277 and CVE-2026-20700, and the deployed malware families GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER, supporting iOS versions 18.4 through 18.7. → cloud.google.com
2026-04-16 2026Inside DarkSword: A New iOS Exploit Kit - iVerify newsLibrary detailing the DarkSword iOS exploit kit, a JavaScript-based framework delivered via waterhole attacks targeting iPhones running iOS 18.4 through 18.6.2. The kit includes Safari exploits, sandbox escapes, privilege escalation, and in-memory implants for data exfiltration, leveraging vulnerabilities patched by Apple in iOS 26.1, 26.2, and 26.3. The analysis uncovered infrastructure in Estonia and Ukraine, with code comments in Russian and English, and identified specific exploit stages such as `rce_loader.js`, `rce_worker_18.6.js`, `/sbx0_main_18.4.js`, and `/pe_main.js` targeting the `mediaplaybackd` daemon.
2026-04-16 2026DarkSword iOS Exploit Kit: 6 Flaws and 3 Zero-Days for Full Takeover advancedLibrary leveraging six iOS vulnerabilities, including zero-days CVE-2026-20700, CVE-2025-43529, and CVE-2025-14174, to steal sensitive data from iPhones running iOS 18.4 through 18.7. This JavaScript-based exploit chain, dubbed DarkSword, achieves code execution via JavaScriptCore vulnerabilities like CVE-2025-31277, escapes sandboxes through GPU processes, and escalates privileges via kernel flaws like CVE-2025-43520, ultimately exfiltrating information within minutes. → thehackernews.com
2026-04-13 2026Google Blocks 2.36 Million Risky Android Apps from Play Store in 2024 newsAnalysis of Google's 2024 Android app security initiatives reveals a proactive stance against 2.36 million risky app submissions, aided by AI-powered reviews in 92% of cases. Google also banned 158,000 developer accounts, prevented 1.3 million apps from gaining excessive permissions, and enhanced Google Play Protect with daily scans of over 200 billion apps. Developer tools, including an expanded Play SDK index and increased Play Integrity API adoption, further bolster security, while an untrusted APK installation blocking system was rolled out to multiple countries.
2026-04-11 2026Exploiting Content Providers in Android Applications intermediateExploiting Content Providers in Android Applications
2026-04-11 2026SQL injection vulnerabilities in Owncloud Android app intermediateAdvisories detail SQL injection vulnerabilities in the Owncloud Android app, specifically impacting the `FileContentProvider` (GHSL-2022-059) and the `ReceiveExternalFilesActivity`. The `FileContentProvider` allows malicious applications to exploit SQL injection flaws through its `delete`, `insert`, `query`, and `update` methods, potentially leading to unauthorized data access or modification within the app's databases. Additionally, improper sanitization of externally provided file paths in `ReceiveExternalFilesActivity` can allow attackers to read from or write to the application's internal storage. → securitylab.github.com
2026-04-11 2026Android, SQL and ContentProviders - Why SQL injections aren't dead yet intermediateWriteup detailing SQL injection vulnerabilities within Android Content Providers. It explains how these providers, used for inter-process data communication, can be exploited when user-supplied input is not properly sanitized before being used in SQL queries. The article uses the Yahoo Weather app's Content Providers as a specific example, illustrating the mechanisms that allow for these injection attacks.
2026-04-11 2026iOS Universal Links - HackTricks beginnerReference detailing iOS Universal Links, focusing on penetration testing implications. It covers the `apple-app-site-association` file, its configuration via Xcode entitlements with `applinks:`, and methods for retrieving and validating it using tools like AASA Validator, GetUniversal.link, and Knil. The entry also discusses how apps handle these links via `application:continueUserActivity:restorationHandler:` and emphasizes URL validation to prevent spoofing, mentioning CVE-2024-10474 as a related vulnerability.
2026-04-11 2026MASTG-TEST-0070: Testing Universal Links intermediateGuide to testing Universal Links on iOS applications, covering static analysis of the Associated Domains entitlement, retrieval of the Apple App Site Association file using tools like the AASA Validator, and verification of the link receiver method (`application:continueUserActivity:restorationHandler:`) and data handler method within the app delegate, emphasizing URL parameter validation and the use of HTTPS. → mas.owasp.org
2026-04-11 2026Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped intermediateLibrary demonstrating iOS URL scheme hijacking via OAuth. This technique leverages `ASWebAuthenticationSession` and the `prompt=none` OAuth parameter to silently steal authentication codes from vulnerable applications, potentially leading to account takeover. The attack exploits how iOS handles redirects within in-app browsers and custom URL schemes, bypassing common protections like PKCE.
2026-04-11 2026Android security checklist: WebView - Oversecured Blog beginnerChecklist of common Android WebView vulnerabilities, including insufficient URL validation (scheme bypasses via `javascript://`, `file://`, `content://`, and reflection API attacks), Universal XSS, JavaScript injection, and insecure internal URL handlers. The guide details attacks on JavaScript interfaces, universal/file access from file URLs, and arbitrary file theft via file choosers, citing examples like `DeeplinkActivity` and `OVAA`.
2026-04-11 2026WebView addJavascriptInterface Remote Code Execution - WithSecure Labs intermediateWriteup detailing remote code execution in Android WebView's `addJavascriptInterface`. This vulnerability, affecting all current Android platforms, allows attackers to inject JavaScript into a WebView, potentially via Man-in-the-Middle attacks on advertising SDKs. By abusing the `JavascriptInterface` and reflection, attackers can leverage `java.lang.Runtime` to execute arbitrary operating system commands and deploy payloads like `drozer`'s `weasel`. The exploit mechanism is demonstrated by executing shell commands and establishing a reverse TCP shell connection.
2026-04-11 2026Exploiting Insecure Android WebView with JavaScript Interface intermediateExploiting Insecure Android WebView with JavaScript Interface

Frequently Asked Questions

What is the OWASP Mobile Top 10?
The OWASP Mobile Top 10 covers the most critical mobile application security risks: Improper Credential Usage, Inadequate Supply Chain Security, Insecure Authentication/Authorization, Insufficient Input/Output Validation, Insecure Communication, Inadequate Privacy Controls, Insufficient Binary Protections, Security Misconfiguration, Insecure Data Storage, and Insufficient Cryptography.
What tools are used for mobile app security testing?
Essential tools include Frida and objection for dynamic instrumentation, MobSF for automated static and dynamic analysis, Jadx and apktool for Android reverse engineering, Hopper and Ghidra for iOS binary analysis, and proxy tools like Burp Suite or mitmproxy for intercepting API traffic with certificate pinning bypass.
How is mobile security testing different from web testing?
Mobile testing adds client-side concerns: local data storage, binary protections, certificate pinning, inter-app communication, and platform-specific features. You must analyze the compiled binary, not just network traffic. Reverse engineering reveals hardcoded secrets, hidden endpoints, and client-side logic that attackers can manipulate.

Weekly AppSec Digest

Get new resources delivered every Monday.