The newest Mobile Security resources are on the Mobile Security page. For a reading order instead of a date order, see the Mobile Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-22 2026 | Root/Jailbreak Detection and SSL Pinning in KMM intermediate 8 min read | Library implementing root/jailbreak detection and SSL pinning for Kotlin Multiplatform Mobile (KMM) applications. It details platform-specific techniques for detecting rooted Android devices by checking for the `su` binary or common root packages, and for jailbroken iOS devices by looking for Cydia or writable system directories. The library also covers SSL pinning using OkHttpClient on Android and a custom URLSessionDelegate with proxy detection on iOS to prevent man-in-the-middle attacks. The article further explores how attackers bypass these protections, particularly using Frida for dynamic instrumentation. |
| 2026-04-22 2026 | Reversing Android Apps: Bypassing Detection Like a Pro intermediate 4 min read | Library for bypassing common Android app detection mechanisms like Frida, root checks, and SSL pinning. Techniques include utilizing Magisk DenyList, employing Frida codeshare scripts, attaching Frida after app launch, static analysis with Jadx to identify and patch detection code, using Objection's `patchapk` feature, dumping loaded classes, tracing method calls, reversing native JNI code, and patching SSL pinning with `apk-mitm` for network traffic analysis. |
| 2026-04-22 2026 | Reverse engineering and modifying Android apps with JADX and Frida intermediate 18 min read | Library for reverse engineering and modifying Android applications, utilizing JADX for code extraction and Frida for dynamic instrumentation. This resource details how to decompile APKs, analyze Java source code generated by JADX, and write custom Frida scripts to bypass security measures like certificate pinning, enabling traffic interception with tools like HTTP Toolkit. It covers techniques applicable to understanding and altering app behavior beyond standard certificate pinning implementations. |
| 2026-04-22 2026 | Common Vulnerabilities and Exposures Examples in Mobile Apps beginner 6 min read | Library for validating mobile application CVEs, enabling security teams to reproduce exploits and analyze vulnerabilities in virtualized iOS and Android environments. It supports automated security assessments, real-time reporting, and tools like Frida for hooking and tracing behavior, addressing challenges posed by the rising volume of CVEs and the limitations of testing within app sandboxes. This approach moves beyond static CVE database entries to provide actionable insights into exploitable risks, exemplified by issues like CVE-2024-26131 in the Element Android App and the Operation Triangulation CVE chain impacting iOS. |
| 2026-04-22 2026 | Bypassing iOS Frida Detection with LLDB and Frida intermediate 5 min read | Writeup details bypassing iOS Frida detection using LLDB and Frida. The process involves jailbreaking an iPhone, setting up development tools like `libimobiledevice`, `frida-tools`, and LLDB, and then using `debugserver` for remote debugging. The author demonstrates how to find and breakpoint `FridaInTheMiddle.systemSanityCheck()` with LLDB to bypass detection, trace the `dummyFunction(flag:)` Swift function using `frida-trace` to get its mangled name, and finally hook this function with a Frida script to intercept and decode the Swift string argument, ultimately revealing the flag. |
| 2026-04-22 2026 | frida-interception-and-unpinning: Scripts to MitM all HTTPS traffic intermediate 8 min read | Library of Frida scripts automates HTTPS MitM interception on mobile devices by redirecting traffic to a proxy, injecting CA certificates into trust stores, and patching certificate pinning and transparency checks. It also handles fallback patching for obfuscated certificate pinning on Android, disables root/jailbreak detection, and blocks HTTP/3 connections. The scripts can be used independently or together to intercept HTTP(S) traffic on Android and iOS. |
| 2026-04-22 2026 | Android Reports and Resources beginner 2 min read | Library of Android security reports and resources detailing vulnerabilities such as CVE-2020-8913 in the Google Play Core library, path traversal, account takeover via deep links, sensitive information disclosure, arbitrary code execution in TikTok, memory corruption exploitation, SQL injection in Content Providers, and XSS via WebView. It includes resources on secure cryptography, WebResourceResponse configurations, and vendor-specific issues in Xiaomi and Samsung devices, alongside references to vulnerable Android applications like Oversecured, GoatDroid, and Sieve for educational purposes. |
| 2026-04-22 2026 | iOS Security Testing - OWASP MASTG beginner 7 min read | Library for iOS security testing, detailing environment setup with macOS hosts, jailbroken devices, and tools like Burp Suite or OWASP ZAP. It covers obtaining device UDIDs via Finder or command-line tools such as `idevice_id` and `instruments`, and contrasts iOS simulators with emulators, noting the simulator's limitations for reverse engineering. The library also explains jailbreaking concepts, contrasting them with Android rooting, and highlights the benefits of privileged access for security testers, including root file system access and unrestricted debugging. It further categorizes jailbreak types (tethered, semi-tethered, semi-untethered, untethered) and discusses the challenges of maintaining jailbroken devices due to Apple's security hardening and signing mechanisms, mentioning exploits like CVE-2015-6794 and CVE-2015-7037. → mas.owasp.org |
| 2026-04-22 2026 | Android Security Bulletin - March 2026 news 6 min read | Bulletin detailing security vulnerabilities affecting Android devices, including critical remote code execution flaws in the System component. Patches are available for security patch levels 2026-03-01 and 2026-03-05, addressing issues in Framework, System, Kernel, and various vendor components like Arm, MediaTek, Unisoc, and Qualcomm. Android and Google Play Protect mitigations are discussed to enhance device security. |
| 2026-04-22 2026 | Android Security Bulletin - April 2026 news 5 min read | Bulletin detailing critical vulnerabilities in Android Framework, potentially leading to local denial of service without requiring user interaction or execution privileges. It addresses issues with security patch levels 2026-04-01 and 2026-04-05, affecting components from Google, NXP, STMicroelectronics, and Thales. The document also covers Android and Google Play Protect mitigations, emphasizing the importance of updating to the latest Android versions. |
| 2026-04-19 2026 | Zero-Day Vulnerabilities in Apple WebKit — CSA Singapore news | Zero-Day Vulnerabilities in Apple WebKit — CSA Singapore |
| 2026-04-19 2026 | Update Apple Devices: Actively Exploited CVE-2025-14174 & CVE-2025-43529 news 2 min read | Writeup of CVE-2025-14174 and CVE-2025-43529, actively exploited WebKit vulnerabilities in Apple devices. CVE-2025-14174, an out-of-bounds memory access flaw in ANGLE for Chrome on Mac, and CVE-2025-43529, a WebKit vulnerability, may have been used in tandem to execute arbitrary code via crafted HTML pages. Both have been addressed in recent iOS, macOS, tvOS, watchOS, visionOS, and Safari updates, and CVE-2025-43529 is now on CISA's Known Exploited Vulnerabilities catalog. → helpnetsecurity.com |
| 2026-04-19 2026 | Two Serious Vulnerabilities in Latest Android Security Update news | Two Serious Vulnerabilities in Latest Android Security Update |
| 2026-04-19 2026 | LANDFALL: New Commercial-Grade Android Spyware (CVE-2025-21042) news 23 min read | Analysis of LANDFALL, a commercial-grade Android spyware targeting Samsung Galaxy devices, details its exploitation of CVE-2025-21042, a zero-day vulnerability in Samsung’s image processing library. Delivered via malicious DNG image files, potentially through WhatsApp, LANDFALL facilitates comprehensive surveillance. This operation, active since mid-2024 and patched in April 2025, predates public disclosures of similar exploit chains involving CVE-2025-21043 and iOS vulnerabilities, suggesting links to private-sector offensive actors in the Middle East. → unit42.paloaltonetworks.com |
| 2026-04-16 2026 | Awesome Android Reverse Engineering: Curated List beginner 5 min read | Library of curated training, tools, and resources for Android reverse engineering, covering static and dynamic analysis techniques, decompilation with JADX and Ghidra, dynamic instrumentation with Frida and Objection, network analysis using Burp Suite and Wireshark, and popular tools like MobSF, QARK, and Androguard. It also lists resources for obfuscation, anti-reversing, firmware analysis, and includes CTFs and crackmes for hands-on practice. |
| 2026-04-16 2026 | Android App Reverse Engineering 101 beginner 1 min read | Workshop slides introduce static analysis techniques for reverse engineering Android applications, focusing on understanding code without execution. Exercises are performed within a provided Ubuntu 18.04 VM pre-loaded with necessary tools, with a username of "AndroidAppRE" and password "android." This resource builds foundational skills applicable to areas like Android malware analysis and vulnerability hunting. |
| 2026-04-16 2026 | Exploiting Android Fingerprint Authentication intermediate | Exploiting Android Fingerprint Authentication |
| 2026-04-16 2026 | Android Keystore Pitfalls and Best Practices intermediate 15 min read | Library detailing Android Keystore pitfalls, this resource examines the complexities of mobile biometric authentication within the Android ecosystem. It highlights how half of tested Android apps fail OWASP AUTH-2 standards and how many fingerprint authentications can be bypassed. Best practices are discussed, emphasizing the importance of `UserAuthenticationRequired` for cryptographic keys and proper utilization of `CryptoObject` for secure data encryption/decryption, contrasting with insecure event-based or non-cryptographic implementations. |
| 2026-04-16 2026 | Frida's Impact on Mobile Security and How to Fight Back intermediate | Frida's Impact on Mobile Security and How to Fight Back |
| 2026-04-16 2026 | From an Android Hook to RCE: $5000 Bounty intermediate | From an Android Hook to RCE: $5000 Bounty |
| 2026-04-16 2026 | iOS Reverse Engineering: Defeating Anti-Debug and Extracting Hidden Flag intermediate 4 min read | Walkthrough of bypassing anti-debug and anti-Frida mechanisms in an iOS application to extract a hidden flag. This process involves static analysis using `rabin2` to find relevant strings, dynamic analysis with `FridaGadget` embedded via `insert_dylib`, and runtime instrumentation with a custom Frida script. The technique leverages `TrollStore` for installation and `FridaGadget.dylib` to bypass runtime detection and hook `UILabel` updates, ultimately revealing the flag. |
| 2026-04-16 2026 | DarkSword iOS Exploit Chain Adopted by Multiple Threat Actors - Google news 20 min read | Library for detecting and analyzing the DarkSword iOS exploit chain, which leverages multiple zero-day vulnerabilities to compromise devices. It details its use by various threat actors, including UNC6748, against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. The library identifies specific vulnerabilities like CVE-2025-31277 and CVE-2026-20700, and the deployed malware families GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER, supporting iOS versions 18.4 through 18.7. → cloud.google.com |
| 2026-04-16 2026 | Inside DarkSword: A New iOS Exploit Kit - iVerify news 11 min read | Library detailing the DarkSword iOS exploit kit, a JavaScript-based framework delivered via waterhole attacks targeting iPhones running iOS 18.4 through 18.6.2. The kit includes Safari exploits, sandbox escapes, privilege escalation, and in-memory implants for data exfiltration, leveraging vulnerabilities patched by Apple in iOS 26.1, 26.2, and 26.3. The analysis uncovered infrastructure in Estonia and Ukraine, with code comments in Russian and English, and identified specific exploit stages such as `rce_loader.js`, `rce_worker_18.6.js`, `/sbx0_main_18.4.js`, and `/pe_main.js` targeting the `mediaplaybackd` daemon. |
| 2026-04-16 2026 | DarkSword iOS Exploit Kit: 6 Flaws and 3 Zero-Days for Full Takeover advanced 6 min read | Library leveraging six iOS vulnerabilities, including zero-days CVE-2026-20700, CVE-2025-43529, and CVE-2025-14174, to steal sensitive data from iPhones running iOS 18.4 through 18.7. This JavaScript-based exploit chain, dubbed DarkSword, achieves code execution via JavaScriptCore vulnerabilities like CVE-2025-31277, escapes sandboxes through GPU processes, and escalates privileges via kernel flaws like CVE-2025-43520, ultimately exfiltrating information within minutes. → thehackernews.com |
| 2026-04-13 2026 | Google Blocks 2.36 Million Risky Android Apps from Play Store in 2024 news 5 min read | Analysis of Google's 2024 Android app security initiatives reveals a proactive stance against 2.36 million risky app submissions, aided by AI-powered reviews in 92% of cases. Google also banned 158,000 developer accounts, prevented 1.3 million apps from gaining excessive permissions, and enhanced Google Play Protect with daily scans of over 200 billion apps. Developer tools, including an expanded Play SDK index and increased Play Integrity API adoption, further bolster security, while an untrusted APK installation blocking system was rolled out to multiple countries. |
| 2026-04-11 2026 | Exploiting Content Providers in Android Applications intermediate | Exploiting Content Providers in Android Applications |
| 2026-04-11 2026 | SQL injection vulnerabilities in Owncloud Android app intermediate 10 min read | Advisories detail SQL injection vulnerabilities in the Owncloud Android app, specifically impacting the `FileContentProvider` (GHSL-2022-059) and the `ReceiveExternalFilesActivity`. The `FileContentProvider` allows malicious applications to exploit SQL injection flaws through its `delete`, `insert`, `query`, and `update` methods, potentially leading to unauthorized data access or modification within the app's databases. Additionally, improper sanitization of externally provided file paths in `ReceiveExternalFilesActivity` can allow attackers to read from or write to the application's internal storage. → securitylab.github.com |
| 2026-04-11 2026 | Android, SQL and ContentProviders - Why SQL injections aren't dead yet intermediate 12 min read | Writeup detailing SQL injection vulnerabilities within Android Content Providers. It explains how these providers, used for inter-process data communication, can be exploited when user-supplied input is not properly sanitized before being used in SQL queries. The article uses the Yahoo Weather app's Content Providers as a specific example, illustrating the mechanisms that allow for these injection attacks. |
| 2026-04-11 2026 | iOS Universal Links - HackTricks beginner 4 min read | Reference detailing iOS Universal Links, focusing on penetration testing implications. It covers the `apple-app-site-association` file, its configuration via Xcode entitlements with `applinks:`, and methods for retrieving and validating it using tools like AASA Validator, GetUniversal.link, and Knil. The entry also discusses how apps handle these links via `application:continueUserActivity:restorationHandler:` and emphasizes URL validation to prevent spoofing, mentioning CVE-2024-10474 as a related vulnerability. |
| 2026-04-11 2026 | MASTG-TEST-0070: Testing Universal Links intermediate 14 min read | Guide to testing Universal Links on iOS applications, covering static analysis of the Associated Domains entitlement, retrieval of the Apple App Site Association file using tools like the AASA Validator, and verification of the link receiver method (`application:continueUserActivity:restorationHandler:`) and data handler method within the app delegate, emphasizing URL parameter validation and the use of HTTPS. → mas.owasp.org |
| 2026-04-11 2026 | Mobile OAuth Attacks - iOS URL Scheme Hijacking Revamped intermediate 6 min read | Library demonstrating iOS URL scheme hijacking via OAuth. This technique leverages `ASWebAuthenticationSession` and the `prompt=none` OAuth parameter to silently steal authentication codes from vulnerable applications, potentially leading to account takeover. The attack exploits how iOS handles redirects within in-app browsers and custom URL schemes, bypassing common protections like PKCE. |
| 2026-04-11 2026 | Android security checklist: WebView - Oversecured Blog beginner 8 min read | Checklist of common Android WebView vulnerabilities, including insufficient URL validation (scheme bypasses via `javascript://`, `file://`, `content://`, and reflection API attacks), Universal XSS, JavaScript injection, and insecure internal URL handlers. The guide details attacks on JavaScript interfaces, universal/file access from file URLs, and arbitrary file theft via file choosers, citing examples like `DeeplinkActivity` and `OVAA`. |
| 2026-04-11 2026 | WebView addJavascriptInterface Remote Code Execution - WithSecure Labs intermediate 8 min read | Writeup detailing remote code execution in Android WebView's `addJavascriptInterface`. This vulnerability, affecting all current Android platforms, allows attackers to inject JavaScript into a WebView, potentially via Man-in-the-Middle attacks on advertising SDKs. By abusing the `JavascriptInterface` and reflection, attackers can leverage `java.lang.Runtime` to execute arbitrary operating system commands and deploy payloads like `drozer`'s `weasel`. The exploit mechanism is demonstrated by executing shell commands and establishing a reverse TCP shell connection. |
| 2026-04-11 2026 | Exploiting Insecure Android WebView with JavaScript Interface intermediate | Exploiting Insecure Android WebView with JavaScript Interface |
| 2026-04-11 2026 | Mobile Security Framework - MobSF Documentation beginner | Mobile Security Framework - MobSF Documentation |
| 2026-04-11 2026 | MobSF: Mobile Security Framework (GitHub) beginner 2 min read | Library for mobile application security, penetration testing, malware analysis, and privacy analysis on Android, iOS, and Windows Mobile. MobSF supports static analysis of APK, IPA, and APPX binaries, as well as dynamic analysis with instrumented testing, runtime data, and network traffic analysis for Android and iOS. It integrates with DevSecOps pipelines via REST APIs and CLI tools. |
| 2026-04-11 2026 | Deep Linking Vulnerabilities - Application Security Cheat Sheet beginner | Deep Linking Vulnerabilities - Application Security Cheat Sheet → 0xn3va.gitbook.io |
| 2026-04-11 2026 | Android Intent Redirection: A Hacker's Gateway to Internal Components intermediate | Android Intent Redirection: A Hacker's Gateway to Internal Components |
| 2026-04-11 2026 | From Browser to Breach: One-Click Android Deep Link Exploitation intermediate | From Browser to Breach: One-Click Android Deep Link Exploitation |
| 2026-04-11 2026 | Unsafe use of deep links - Android Developers Security beginner 2 min read | Library for secure deep link implementation on Android, addressing risks like hijacking and data validation attacks that can lead to cross-app scripting or remote code execution. It details mitigations such as using `android:autoVerify="true"` in `AndroidManifest.xml` to prevent malicious apps from intercepting links, and emphasizes robust data validation for all incoming parameters, referencing techniques discussed in Android Developers Security and OWASP MASVS-PLATFORM. |
| 2026-04-11 2026 | Android Pentest: Deep Link Exploitation intermediate 5 min read | Library for analyzing Android deep link vulnerabilities, demonstrating exploitation techniques for sensitive data exposure, session hijacking, account takeovers, open redirects, LFI, and XSS. It details how insecure implementations of custom URL schemes, as found in applications like InjuredAndroid, can be leveraged through tools like Drozer and phishing pages to gain unauthorized access or data. Recommendations include using `android:autoVerify="true"` and `assetlinks.json` for secure verification. |
| 2026-04-11 2026 | A Comprehensive Guide to iOS Jailbreak Detection Bypass intermediate 6 min read | Library for bypassing iOS jailbreak detection, detailing one-time bypass using Liberty and run-time bypass with Frida and Objection. It explains how to hook methods, manipulate return values to spoof non-jailbroken status, and lists common file paths applications can check to detect jailbroken devices. |
| 2026-04-11 2026 | Bypassing iOS Security Suite: Jailbreak Detection Explained and Tested intermediate 8 min read | Library for iOS developers to implement jailbreak detection, emulator detection, and more within their applications. The iOS Security Suite's jailbreak checks, including URL schemes, suspicious files, restricted directories, fork, DYLD, and ObjC classes, can be bypassed by overriding the `amIJailbroken()` method using tools like Frida, revealing potential security risks in apps that don't layer their defenses. |
| 2026-04-11 2026 | Frida CodeShare: iOS Jailbreak Detection Bypass intermediate | Frida CodeShare: iOS Jailbreak Detection Bypass |
| 2026-04-11 2026 | iOS Jailbreak Detection Bypass with Frida - Full Guide intermediate 6 min read | Library for bypassing iOS jailbreak detection using Frida. This guide details how to leverage Corellium's virtualized platform to identify and hook specific methods within applications like DVIA-2. It covers setup, class and method enumeration, and modifying boolean return values to circumvent detection mechanisms, enabling dynamic analysis and security testing of iOS applications. |
| 2026-04-11 2026 | Android 15 Vulnerabilities: A Comprehensive Security Research Analysis advanced | Android 15 Vulnerabilities: A Comprehensive Security Research Analysis |
| 2026-04-11 2026 | December 2025 Android Security Bulletin: Two Zero-Day Flaws Exploited news 6 min read | Analysis of the December 2025 Android Security Bulletin, detailing over 100 vulnerabilities. This release highlights two zero-day Framework exploits, CVE-2025-48633 (information disclosure) and CVE-2025-48572 (elevation of privilege), which are under limited, targeted exploitation across Android 13-16. The bulletin also addresses a critical Framework DoS (CVE-2025-48631), kernel privilege escalations (including pKVM and IOMMU issues), and vendor-specific flaws in Arm, Imagination GPU, MediaTek, Unisoc, and Qualcomm components. → socradar.io |
| 2026-04-11 2026 | Android Security Bulletin - December 2025 news 6 min read | Bulletin detailing security vulnerabilities affecting Android devices, with patch levels 2025-12-01 and 2025-12-05 addressing critical issues in Framework, System, and Kernel components. The bulletin references specific CVE IDs and notes mitigations provided by Android security platform protections and Google Play Protect. Updates incorporate fixes for Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm components. |
| 2026-04-11 2026 | Intent redirection vulnerability in third-party SDK exposed millions of Android wallets intermediate 9 min read | Writeup details an intent redirection vulnerability in the EngageSDK, a third-party Android library used by millions of applications, including crypto wallets. This flaw allowed malicious apps to bypass Android's security sandbox and access sensitive user data, including PII and financial information. The vulnerability, identified in the exported `MTCommonActivity` component, enabled attackers to craft intents that, when processed by the vulnerable SDK, could lead to unauthorized access, data exposure, and privilege escalation. While Google removed affected apps from the Play Store and provided platform-level mitigations, developers are urged to update to EngageSDK version 5.2.1 to resolve the issue. → microsoft.com |
| 2026-04-10 2026 | Mobile App Security Testing Guide 2026 beginner 6 min read | Library for comprehensive mobile application security testing, covering Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), API security, and forensic analysis. It highlights the importance of addressing vulnerabilities like weak authentication, data leaks, and insecure APIs, citing the high cost of breaches and regulatory penalties. Key tools such as MobSF, Frida, OWASP ZAP, Burp Suite, Drozer, QARK, and Objection are mentioned, along with the OWASP Mobile Top 10 and MASVS standards. |