Mobile Security
OWASP Top 10 for Mobile Security
OWASP Top 10 for mobile application security, covering platform-specific vulnerabilities, insecure data storage, and authentication issues.
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Improper Platform Usage | Misuse of platform features or failure to apply platform security controls enables attacks. | View Details |
| #2 | Insecure Data Storage | Sensitive data stored insecurely on the device can be accessed by other apps or through physical access. | View Details |
| #3 | Insecure Communication | Data transmitted between the app and backend without proper encryption is vulnerable to interception. | View Details |
| #4 | Insecure Authentication | Weak authentication mechanisms allow unauthorized access to mobile apps and backend services. | View Details |
| #5 | Insufficient Cryptography | Weak or custom cryptographic implementations fail to protect sensitive data adequately. | View Details |
| #6 | Insecure Authorization | Missing or weak authorization checks allow users to access data or functions beyond their permissions. | View Details |
| #7 | Client Code Quality | Poor coding practices in mobile apps introduce vulnerabilities like buffer overflows and injection flaws. | View Details |
| #8 | Code Tampering | Attackers can modify app binaries to bypass security controls, inject malicious code, or extract secrets. | View Details |
| #9 | Reverse Engineering | Insufficient protections allow attackers to analyze app internals, extract secrets, and understand business logic. | View Details |
| #10 | Extraneous Functionality | Hidden or undocumented features like debug interfaces and test endpoints create unintended attack vectors. | View Details |