You already know the Android permission model is broken. You probably joke about it. What you might not realise is that it’s not just…

A developer recently spotted a notable proposal. Google engineers want to curb a potential security flaw in the Android Debug Bridge, or ADB. To do so, they suggest restricting local ADB connectio…

APK signature verification is commonly implemented in Android applications to detect tampering and ensure that only the original…

Android’s crowning convenience for power users may soon vanish as Google endeavors to fortify system security. Company engineers have proposed prohibiting devices from connecting to their in…

17 findings, 2 Critical, and one recurring lesson: the mobile client is never a safe place to trust

TL;DR A researcher at ByteriaLab found a zero-click flaw in Xiaomi ShareMe, also shipped as MiDrop. An attacker within Bluetooth LE range can write arbitrary files to a victim’s phone the mo…

In this blog, i’ll walk you through the Beginner-level lab of Secure Notes in MobileHackingLab. This is my first experience with mobile…

A small note from me

Preinstalled smartphone applications frequently operate with high system privileges. Security researchers recently uncovered a severe OnePlus session takeover vulnerability. This flaw directly imp…

The Google Play Store is one of the primary gateways through which billions of Android users discover and install applications.

An entirely ordinary Android application, devoid of any requested permissions, can now seize absolute control over contemporary flagship smartphones. Calif researcher Lucas Maar brilliantly demons…

A semi-technical writeup of the cat-and-mouse game between Android emulators, Magisk, and Google’s Play Integrity API — and how we won (for…

Target: com.hacker101.level13 Category: Android / Mobile Difficulty: Moderate Vulnerability class: CWE-321 — Use of Hard-coded…

Purpose: A practical, beginner-friendly reference for reviewing the four : Java fundamentals, cryptography and Android fundamentals…

TL;DR The October 2026 MediaTek security bulletin patches 31 vulnerabilities across its smartphone, tablet and IoT chipsets. Two critical modem flaws, CVE-2026-20519 and CVE-2026-20520, let a rogu…

Welcome to mobile security.

From source code analysis to a working proof of concept: investigating an authorization gap in an Android ContentProvider.

To understand the Android operating system completely, it is best to walk through it in logical and chronological order.

A beginner’s notes on how mobile apps are tested for security problems, and the tools testers use.

Objective