MOBILE - OWASP TOP 10
The OWASP Mobile Top 10 (2024 Final Release) is the latest list that will drive mobile security testing guidance for 2025. It distills the most critical risks observed across modern Android and iOS applications, covering everything from credential handling to cryptography and privacy controls. Understanding these categories helps engineering and security teams prioritise remediation work that has the highest impact on user safety and regulatory compliance.
Why This List Matters
- Mobile-first attacks are growing – adversaries increasingly target mobile apps for credentials, payment data, and access tokens.
- Regulatory scrutiny is rising – sectors such as finance, healthcare, and retail must demonstrate strong mobile security to meet compliance obligations.
- Complex ecosystems – mobile apps rely on supply-chain services, SDKs, and device APIs, expanding the potential attack surface.
How To Use This Section
For each risk in the Mobile Top 10 you will find:
- A concise description of the issue and why it is dangerous.
- Typical weakness patterns, testing cues, and telemetry to monitor.
- Practical mitigation guidance aligned with secure-by-design principles.
Whether you are integrating security checks into CI/CD pipelines, planning a penetration test, or coaching mobile engineers, the following chapters provide an actionable playbook for the 2024/2025 mobile threat landscape.
In this section
- M1: Improper Credential UsageImproper credential usage covers hardcoded secrets, weak credential lifecycles, and unsafe handling of session artefacts.
- M2: Inadequate Supply Chain SecurityMobile apps depend on package repositories, third-party SDKs, advertising libraries, CI/CD services, and device-side frameworks.
- M3: Insecure Authentication/AuthorizationInsecure authentication and authorization flaws allow attackers to bypass login flows, escalate privileges, or hijack sessions.
- M4: Insufficient Input/Output ValidationMobile apps constantly process data from user input, device sensors, inter-app communication, and backend APIs.
- M5: Insecure CommunicationMobile devices operate on untrusted networks—public Wi-Fi, carrier infrastructure, and captive portals.
- M6: Inadequate Privacy ControlsInadequate privacy controls mean the app collects, processes, or shares personal data without sufficient transparency, consent, or safeguards.
- M7: Insufficient Binary ProtectionsInsufficient binary protections make it easier for attackers to reverse engineer, tamper with, or instrument the mobile app.
- M8: Security MisconfigurationSecurity misconfiguration encompasses insecure defaults, missing hardening, or ad-hoc changes that leave the…
- M9: Insecure Data StorageInsecure data storage exposes sensitive information on the device or supporting services.
- M10: Insufficient CryptographyInsufficient cryptography covers weak algorithms, poor key lifecycle management, and incorrect integration of cryptographic primitives.
Last updated
