Mobile misconfigurations are often single manifest or plist settings: android:debuggable, android:exported, allowBackup, usesCleartextTraffic, or overly broad URL schemes. Each one can let another app on the device or an attacker with physical access read data, invoke internal activities, or attach a debugger.
Ship release builds with debugging disabled, mark components as non-exported unless required and protect exported ones with permissions, set restrictive file modes, disable backups for sensitive data, and verify configuration with automated checks in CI.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#08mobile08-2024 Security Misconfiguration
