Blog

Most mobile app code comes from third-party SDKs, not your team. Learn why traditional SAST tools can't see this attack surface and how to fix it.

SDK security in mobile apps: the attack surface your team didn't write

Most mobile app code comes from third-party SDKs, not your team. Learn why traditional SAST tools can't see this attack surface and how to fix it.

Vulnerabilities that lead to account takeover in banking and fintech mobile apps

A technical guide to mobile banking security. Learn the 8 vulnerability categories that cause account takeover in banking and fintech apps, mapped to OWASP MASVS.

Mobile app security testing in CI/CD: how to add security gates without slowing releases

Learn how to integrate mobile app security testing into your CI/CD pipeline with automated SAST/DAST gates, policy enforcement, and a phased rollout plan that keeps release velocity intact

Does obfuscation protect Android apps from attackers?

A technical guide to Android app obfuscation and security. Learn what ProGuard and R8 actually hide from attackers, why taint analysis still works on obfuscated code, and what genuinely protects your app.

Spend less time analyzing vulnerabilities and remediate faster with new Oversecured reports

Oversecured reports now include AI-generated summaries, attack scenarios, and remediation guidance — helping security teams triage and fix mobile vulnerabilities faster.

Android deep link vulnerabilities: how intent filters lead to account takeover

A technical guide to Android deep link security. Learn how intent filter misconfigurations lead to account takeover, and how mobile application security testing with SAST and DAST finds these vulnerability chains.

Inside mobile taint analysis: how source-to-sink tracking finds real data-leak paths

A technical guide to taint analysis in mobile app security testing. Learn how source-to-sink data flow tracking finds real Android vulnerabilities that pattern-matching tools miss.

Mobile app security testing beyond the login screen

A technical guide to authenticated mobile app security testing. Learn what DAST misses when it stops at the login screen, and how automated login agents reach the attack surface that matters most.

Mobile app security testing: how to choose the right platform (buyer’s guide 2026)

A practical buyer’s guide to mobile app security testing tools. Compare SAST, DAST, CI/CD integration, false positive rates, and 11 key criteria for choosing the right platform.

That AI You Confide in May Be an Open Book: Researchers Find Cloud Keys, Exposed Conversations, and Injectable Chat in Companion Apps

Oversecured identifies hardcoded cloud credentials and a cross-site scripting flaw in popular AI companion apps, exposing backend infrastructure and allowing code injection into private conversations

The App You Asked Your Employees to Install Can Leak Their Bank Account Details to Hackers

Security audit of shift scheduling and workforce management apps finds flaws that expose Plaid banking tokens, allow fake messages under the employer's brand, and let attackers silently delete shift notifications

Security Researchers Find Vulnerabilities in Mental Health Apps; One With Millions of Users May Leak Therapy Notes

Oversecured has identified vulnerabilities in several popular mental health apps with tens of millions of downloads. The flaws could turn these apps into unintended data sources for surveillance, including personal conversations with AI

How Mercari strengthened mobile security for millions of users with Oversecured

Discover how Mercari, Japan's largest marketplace app, transformed their mobile security program with Oversecured, uncovering critical vulnerabilities missed by tools and achieving reliable automated scanning at scale.

What is a mobile DAST and why security teams are moving beyond pen testing

Mobile app security has become significantly harder over the past few years. Modern mobile applications rely on dozens of third-party SDKs, complex authentication flows, background services, deeplinks, and constant interaction with device-level APIs.

Disclosure of 7 Android and Google Pixel Vulnerabilities

We continually refine and enhance the Oversecured Mobile Application Vulnerability Scanner through regular analysis of mobile applications. This helps us to optimize our analysis techniques and proactively mitigate potential vulnerabilities from malicious exploitation.

20 Security Issues Found in Xiaomi Devices

Oversecured found and resolved significant mobile security vulnerabilities in Xiaomi devices. Our team discovered 20 dangerous vulnerabilities across various applications and system components that pose a threat to all Xiaomi users. The vulnerabilities

Oversecured Apps Care. Part 1: Vulnerability disclosure of 225 Google apps

Oversecured Apps Care At Oversecured, our core mission is to make the Internet safer for everyone.

Introducing MavenGate: a supply chain attack method for Java and Android applications

This article introduces MavenGate, a supply chain attack method that can let attackers hijack Java and Android dependencies by taking over abandoned domains or project identities. It explains how this weakness appears in common Maven and Gradle workflows, why default dependency resolution can make projects vulnerable, and how malicious code could be injected into apps or build pipelines. The piece also shows the scale of the issue through Oversecured’s research and outlines practical defenses teams can use to reduce the risk.

Content Providers and the potential weak spots they can have

Android security checklist: Content Providers

Discovering vendor-specific vulnerabilities in Android

For several years, Oversecured has been the best way to discover vulnerabilities in Android and iOS mobile apps. We are always carrying out research and improving the quality of our detection. In the

Android security checklist: theft of arbitrary files

Developers for Android do a lot of work with files and exchange them with other apps, for example, to get photos, images, or user data.

Use cryptography in mobile apps the right way

At Oversecured, we scan thousands of apps every month. We observe that some vulnerabilities now come up much less frequently than they did a few years ago. But the same cannot be said

Android security checklist: WebView

WebView is a web browser that can be built into an app, and represents the most widely used component of the Android ecosystem; it is also subject to the largest number of potential

Oversecured detects dangerous vulnerabilities in the TikTok Android app

Oversecured has once again uncovered high-severity vulnerabilities, this time in the TikTok app. The app contained one vulnerability to theft of arbitrary files with user interaction and three to persistent arbitrary code execution.

Common mistakes when using permissions in Android

When an Android app needs access to sensitive resources on the device, the app developers make use of the permissions model. While the model can be quite simple to use, developers often make

Two weeks of securing Samsung devices: Part 2

As mentioned in the first part of this series, Oversecured spent two weeks finding security bugs in Samsung’s built-in apps. In this part, we will go over bugs that could have allowed an

Why dynamic code loading could be dangerous for your apps: a Google example

Almost every Android app dynamically loads code from native .so libraries or .dex files. There are also some special libraries like Google Play Core to simplify this process. text

Two weeks of securing Samsung devices: Part 1

After spending two weeks looking for security bugs in the pre-installed apps on Samsung devices, we were able to find multiple dangerous vulnerabilities. In this blog, we will be going over them.

Android: Exploring vulnerabilities in WebResourceResponse

When it comes to vulnerabilities in WebViews, we often overlook the incorrect implementation of WebResourceResponse which is a WebView class that allows an Android app to emulate the server by returning a response

Exploiting memory corruption vulnerabilities on Android

In today’s blog, we’ll memory corruption vulnerabilities in Android apps and how they can be exploited. At the end of the article, we’ll show how we found such a vulnerability in PayPal

Gaining access to arbitrary* Content Providers

Do you want to check your mobile apps for such types of vulnerabilities? Oversecured mobile apps scanner provides an automatic solution that helps to detect vulnerabilities in Android and iOS mobile apps.

Evernote: Universal-XSS, theft of all cookies from all sites, and more

Oversecured found dangerous vulnerabilities in the Evernote app for Android, which could have allowed access to user accounts to be intercepted by a hostile app installed on the same device.

Interception of Android implicit intents

All intents on Android are divided into two big categories: explicit and implicit. Explicit intents have a set receiver (the name of an app package and the class name of a handler component)

Oversecured automatically discovers persistent code execution in the Google Play Core Library

The Google Play Core Library is a popular library for Android that allows updates to various parts of an app to be delivered at runtime without the participation of the user, via the...

Android: Access to app protected components

This vulnerability resembles Open Redirect in web security. Since class Intent is Parcelable, objects belonging to this class can be passed as extra data in another Intent object. Many developers make use of...

Android: arbitrary code execution via third-party package contexts

There are apps for Android that have the ability to add extra functionality by using external modules. Some load native libraries or third-party dex or app files, but in this article we will...

Book a personalized demo

During the demo with our cybersecurity experts you will get:

A free trial scan of your app

An analysis of your SAST and DAST findings

Practical insights on mobile security of your app

Book a personalized demo

During the demo with our cybersecurity experts you will get:

A free trial scan of your app

An analysis of your SAST and DAST findings

Practical insights on mobile security of your app

Book a personalized demo

During the demo with our cybersecurity experts you will get:

A free trial scan of your app

An analysis of your SAST and DAST findings

Practical insights on mobile security of your app

Dynamic Analysis (DAST)

Static Analysis (SAST)

Interactive Analysis (IAST)

Dynamic Analysis (DAST)

Static Analysis (SAST)

Interactive Analysis (IAST)

Dynamic Analysis (DAST)

Static Analysis (SAST)

Interactive Analysis (IAST)