Mobile Security
OWASP Top 10 for Mobile Security
OWASP Top 10 for mobile application security, covering platform-specific vulnerabilities, insecure data storage, and authentication issues.
Select an Official Release Year
Pick a year to view release rankings, or switch to All Time for the cross-release top 10.
| Rank | Title | Summary | Details |
|---|---|---|---|
| #1 | Insecure Authentication and Session Management | Weak authentication flows, insecure token storage, and poor session handling enable account takeover and unauthorized access. | View Details |
| #2 | Insecure Data Storage and Privacy Leakage | Sensitive data stored without encryption or excessive data collection exposes user privacy and enables data theft. | View Details |
| #3 | Insecure Communication and Network Attacks | Unencrypted or improperly validated network communications enable interception and manipulation of data in transit. | View Details |
| #4 | Insecure Platform Usage and Integration | Misuse of platform APIs, insecure deep links, and improper intent handling create attack vectors through platform features. | View Details |
| #5 | Client-Side Injection and Code Execution | Injection vulnerabilities in webviews, JavaScript interfaces, and native code enable arbitrary code execution on the device. | View Details |
| #6 | Insecure Authorization and Access Control | Missing or bypassable authorization checks allow access to unauthorized data and functions within the app and backend. | View Details |
| #7 | Code Tampering and Reverse Engineering | Insufficient protections against reverse engineering and binary modification enable attackers to analyze and tamper with app behavior. | View Details |
| #8 | Supply Chain and Third-Party Dependencies | Vulnerable or malicious third-party SDKs, libraries, and services introduce risk into mobile applications. | View Details |
| #9 | Device and Environment Security | Running on compromised devices, rooted/jailbroken systems, or insecure environments undermines app security controls. | View Details |
| #10 | Privacy and Data Protection Failures | Excessive data collection, missing consent mechanisms, and inadequate privacy controls violate user trust and regulatory requirements. | View Details |