Skip to main content

OWASP Mobile Top 10

NOTE

This document is for authorized security testing, educational purposes, and defensive engineering only.

1. Overview​

The OWASP Mobile Top 10 lists the most critical security risks for mobile applications. The 2024 revision replaces the 2016 list and aligns with MASVS (Mobile Application Security Verification Standard).

Two revisions matter in practice:

  • 2016 - still referenced in older audit reports, pentest templates, and vendor questionnaires.
  • 2024 - current; use it for new assessments.

This document maps both revisions to the files in this category and to MASVS categories.

2. 2024 List​

IDRiskMASVSCovered in
M1Improper Credential UsageAUTH, STORAGE01 Mobile Security Fundamentals, 03 Android Security (planned), 04 iOS Security (planned)
M2Inadequate Supply Chain SecurityCODE, RESILIENCE05 Mobile Defense and Testing (planned)
M3Insecure Authentication/AuthorizationAUTH01 Mobile Security Fundamentals
M4Insufficient Input/Output ValidationPLATFORM, CODE03 Android Security (planned), 04 iOS Security (planned)
M5Insecure CommunicationNETWORK01 Mobile Security Fundamentals
M6Inadequate Privacy ControlsPRIVACY05 Mobile Defense and Testing (planned)
M7Insufficient Binary ProtectionsRESILIENCE03 Android Security (planned), 05 Mobile Defense and Testing (planned)
M8Security MisconfigurationPLATFORM03 Android Security (planned), 04 iOS Security (planned)
M9Insecure Data StorageSTORAGE, CRYPTO03 Android Security (planned), 04 iOS Security (planned)
M10Insufficient CryptographyCRYPTO01 Mobile Security Fundamentals

3. 2016 vs 2024​

20162024Notes
M1 Improper Platform UsageM8 Security MisconfigurationRenamed, narrowed to configuration issues
M2 Insecure Data StorageM9 Insecure Data StorageSame risk, renumbered
M3 Insecure CommunicationM5 Insecure CommunicationSame risk, renumbered
M4 Insecure AuthenticationM1 + M3Split into credential usage and auth/authz
M5 Insufficient CryptographyM10 Insufficient CryptographySame risk, renumbered
M6 Insecure AuthorizationM3Merged with authentication
M7 Client Code QualityM4Reframed as input/output validation
M8 Code TamperingM7Merged into binary protections
M9 Reverse EngineeringM7Merged into binary protections
M10 Extraneous Functionality(removed)Covered by code review, not a top-10 risk
(new)M2 Supply ChainNew in 2024
(new)M6 Privacy ControlsNew in 2024

Practical note: If a client asks for "OWASP Mobile Top 10 compliance", confirm which revision they mean. A 2024 report that ignores M2 and M6 is incomplete against the current standard.

4. Mapping to This Category​

  • M1, M3, M5, M10 - foundations, covered in 01 Mobile Security Fundamentals.md (storage, communication, auth, crypto).
  • M4, M7, M8, M9 - platform-specific, covered in 03 Android Security.md and 04 iOS Security.md.
  • M2, M6 - process and privacy, covered in 05 Mobile Defense and Testing.md.
  • M7 (binary protections) - also covered by the pentest angle in 01 Mobile Security Fundamentals.md (reverse engineering and tampering).

5. MASVS Categories​

MASVS 2.0 organizes controls into 8 categories (was 7 in 1.x). Mobile Top 10 items map to one or more of these:

MASVSFull nameMapped M-items
MASVS-STORAGEData storageM9
MASVS-CRYPTOCryptographyM10
MASVS-AUTHAuthentication and authorizationM1, M3
MASVS-NETWORKNetwork communicationM5
MASVS-PLATFORMPlatform interactionM4, M8
MASVS-CODECode quality and build settingsM2, M4, M7
MASVS-RESILIENCEResilience against reverse engineering and tamperingM2, M7
MASVS-PRIVACYPrivacy (new in 2.0)M6

6. References​