Mobile Code Quality

What Is Broken and Why

Mobile code quality vulnerabilities arise from using deprecated/unsafe APIs, failing to validate input from local storage or IPC, insecure object deserialization, and shipping with exploitable native code. SQL injection via string-concatenated SQLite queries is common. WebViews that load arbitrary URLs without scheme/host validation allow navigation to attacker-controlled content. Java/Kotlin deserialization of untrusted Parcelables or ObjectInputStream can lead to type confusion and arbitrary code execution. Native code (JNI/NDK) compiled without stack canaries, PIE, or NX creates exploitable memory corruption conditions.

Key Signals

• rawQuery("SELECT * FROM users WHERE id='" + userInput + "'") — string-concatenated SQL
• webView.loadUrl(intent.getStringExtra("url")) — unvalidated URL load
• ObjectInputStream.readObject() on data from Intent extras or ContentProvider
• NSKeyedUnarchiver.unarchiveObject(with:) without class whitelist (iOS < 12)
• Native library without PIE: checksec --file=libapp.so shows No PIE
• Gradle implementation dependency with published CVE in OSS Index
• targetSdkVersion below 30 — misses numerous security improvements
• Implicit Intent used to send sensitive data: sendBroadcast(Intent("ACTION")) without package target
• No version check / forced update mechanism — vulnerable older versions remain in production

Methodology