---
name: mobile-app-security
description: "Guides a reviewer through auditing Android and iOS app clients for deep-link, exported-component, WebView, local-storage, secret, and certificate-validation weaknesses; load when reviewing a mobile app's own attack surface."
---

# Mobile app security

Bugs in Android and iOS apps themselves: deep links and intents, exported components, WebViews, local storage and keychains, secrets in the app, certificate validation. A backend API bug merely reached through the app belongs to the web areas.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 15 newer reports it was not written from: following it finds about 60% of them._

## Mobile app security review

**Approach.** Treat the app as an untrusted boundary: anything another app, a browser, or a crafted link can reach is attacker-controlled input. Your job is to find where that input crosses into privileged behavior. Backend API flaws reached *through* the app belong to the web areas — stay on the client.

**Map first.**
1. Enumerate entry points: manifest `exported` components (activities, services, receivers, providers), intent filters, `BROWSABLE` deep links, universal/app links, custom URL schemes, and any SDK-registered handlers.
2. List WebViews: which activities host them, whether JS is enabled, and what loads into them.
3. List storage: SharedPreferences, files, SQLite, Keychain/Keystore, and what secrets or tokens land there.
4. Note network trust: certificate pinning/validation config, and any hardcoded endpoints or credentials.

**Questions that surface weaknesses.**
- Can another app invoke this component, and does it trust extras/URIs it receives?
- Does a deep link reach a WebView or a sensitive action (mic, messaging, assistant) without user confirmation?
- Are caller-supplied paths or filenames normalized and canonicalized before use?
- Are private-path or scheme checks string-prefix based (bypassable by `../`, symlinks, aliases)?
- Are secrets baked into the bundle, binaries, or passed as method arguments?
- Is certificate validation actually enforced, or overridable?

**Using the patterns.** Each pattern below names a concrete sink. Match your mapped entry points against them: exported component + caller path → path traversal; deep link + WebView → URL injection; intent extras + exported component → trust bypass. Confirm reachability from an untrusted caller before flagging, and record the exact entry point, input, and sink. Skip anything that is purely a server-side API issue.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Exported component path traversal
Exported providers/activities resolving caller-supplied paths or URIs without normalization or scheme checks

_7 reports · 2 confirmed bounties: $100 and $1,337._
Full pattern: https://bugbountylibrary.com/skills/mobile-app-security/exported-component-path-traversal.md

### Unsanitized download filename path traversal
Filename from URL, header, provider, deeplink or ZIP entry used as save path without canonicalization

_7 reports · 3 confirmed bounties, median $475, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/mobile-app-security/path-traversal-filename-write.md

### Deep link URL into WebView
External URL reaching a WebView or rendered link without scheme and host validation

_6 reports · 3 confirmed bounties, median $6,337, up to $8,500._
Full pattern: https://bugbountylibrary.com/skills/mobile-app-security/deeplink-webview-injection.md

### Exported WebView loads attacker content
Exported activity or SDK component passing intent extras into a JavaScript-enabled WebView

_6 reports · 2 confirmed bounties: $400 and $1,075._
Full pattern: https://bugbountylibrary.com/skills/mobile-app-security/exported-webview-arbitrary-load.md

### Exported Android component trusts intent extras
Exported activities, services, providers acting on unvalidated caller-supplied extras or query parameters

_5 reports · one confirmed bounty: $4,000._
Full pattern: https://bugbountylibrary.com/skills/mobile-app-security/exported-component-intent-trust.md

### Secrets embedded in client apps
Hardcoded tokens, keys or basic-auth credentials in APK/IPA bundles, binaries, or runtime method arguments

_5 reports · 2 confirmed bounties: $500 and $38,250._
Full pattern: https://bugbountylibrary.com/skills/mobile-app-security/hardcoded-secrets-client.md

### Path prefix check bypass
String-based private-path or deep-link prefix checks bypassed by symlinks, path aliases, or ../ traversal

_4 reports · 3 confirmed bounties, median $500, up to $750._
Full pattern: https://bugbountylibrary.com/skills/mobile-app-security/path-check-bypass.md

### Deep link auto-triggers sensitive action
BROWSABLE deep links or intents that start mic, assistant, or messaging without a user confirmation step

_3 reports · 3 confirmed bounties, median $3,134._
Full pattern: https://bugbountylibrary.com/skills/mobile-app-security/deeplink-auto-action.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Implicit broadcast leaks sensitive data**: Sensitive data sent via implicit broadcast or mutable PendingIntent without permission (https://bugbountylibrary.com/r/h1%3A1161401.md)
- **OAuth custom scheme without PKCE**: OAuth redirect uses custom URI scheme and lacks PKCE or app-link verification (https://bugbountylibrary.com/r/h1%3A1700734.md)
- **Client-side-only authorization checks**: Privileged actions gated only in app code; replay the API call with a low-privilege token (https://bugbountylibrary.com/r/blog%3Aco0nan-gitbook-io-wirteups.md)
- **In-app browser strips CSP headers**: Custom WebView client removes or ignores Content-Security-Policy response headers (https://bugbountylibrary.com/r/h1%3A1941767.md)
- **Race condition in screen or token swap**: Parameterless screen or token swap races with active state allowing bypass (https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2022-11-10-accidental-70k-google-pixel-lock-screen-bypass.md)
- **Request integrity computed client-side**: Signature or HMAC computed in app code over request parameters, forgeable by attacker (https://bugbountylibrary.com/r/blog%3Ablog-sambal0x-com-2020-04-30-hacking-razer-pay-ewallet-app-html.md)
- **Session cookies leak across WebView loads**: Static header map or cookie store persists session cookies across WebView navigations (https://bugbountylibrary.com/r/h1%3A3475626.md)
- **WebView JS bridge exposed to untrusted content**: Native JS interfaces added to WebView that can load attacker-influenced URLs or HTML (https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-lovestory-from-closed-as-informative-to-xx00-usd-in-yahoo-ios-mail-app.md)