Mobile apps run on devices you do not control, cache sensitive data locally, and talk to backends over untrusted networks. That combination creates risks a web app checklist never covers. The OWASP Mobile Top 10 is the reference list for those risks, and it is the backbone of any serious mobile application penetration test.
Why mobile needs its own Top 10
On the web, your code runs on servers you control. On mobile, your code ships to an attacker’s phone, where it can be decompiled, instrumented, and tampered with at will. Add insecure local storage and the backend APIs every app depends on, and you get a distinct threat model. Here is the current OWASP Mobile Top 10.
The ten risks
M1: Improper Credential Usage. Hardcoded credentials, insecure credential storage, and weak handling of API keys and tokens baked into the app.
M2: Inadequate Supply Chain Security. Vulnerable or malicious third-party SDKs and libraries, a compromised dependency ships inside your app.
M3: Insecure Authentication / Authorization. Weak or bypassable authentication, and authorization decisions made on the client that an attacker can simply skip.
M4: Insufficient Input/Output Validation. Unvalidated data leading to injection, memory issues, or manipulation of app behavior.
M5: Insecure Communication. Weak or missing TLS, absent certificate pinning, and cleartext traffic that lets an attacker on the network intercept data.
M6: Inadequate Privacy Controls. Mishandling of personal data, over-collection, and leaking PII through logs, backups, or third parties.
M7: Insufficient Binary Protections. No obfuscation or anti-tampering, so an attacker can reverse-engineer the app, extract secrets, and repackage it.
M8: Security Misconfiguration. Insecure default settings, debuggable builds shipped to production, and over-permissive platform configurations.
M9: Insecure Data Storage. Sensitive data stored in plaintext files, unprotected databases, or misused keychain/keystore, the classic mobile flaw.
M10: Insufficient Cryptography. Weak algorithms, hardcoded keys, and poor key management that render encryption ineffective.
How to test against it
A mobile assessment aligned to the OWASP Mobile Application Security Verification Standard (MASVS) works through these risks on both platforms:
- Static analysis of the app binary for hardcoded secrets, weak crypto, and insecure configuration
- Dynamic analysis on a running device for insecure storage, runtime tampering, and authentication bypass
- Network testing for TLS, certificate pinning, and cleartext traffic
- Backend API testing, because a mobile app is only as secure as the services behind it
We cover how these layers fit together in our guide to mobile app security testing.
Use it as a testing agenda
The OWASP Mobile Top 10 is most useful as the structure for a real assessment, not a checklist to skim. If you ship an iOS or Android app that handles anything sensitive, work through these ten against your actual build before an attacker does. Scope a mobile assessment and we will test your app and its backend against the full list.
Written by
Invadel Team
Senior penetration testers writing from real engagements — the same team that scopes, tests, and reports for our clients. About Invadel →