OWASP Mobile Top 10

The OWASP Mobile Top 10 is a ranked list of the ten most critical security risks facing mobile applications, published by OWASP (the Open Worldwide Application Security Project) and used by developers, security teams, and auditors as the baseline framework for mobile app security.

The list does not catalog individual bugs. It defines ten risk categories, broad enough to hold dozens of specific vulnerability types, that consistently produce the most damage in mobile apps. Every Appknox testing layer—binary SAST, real-device DAST, and API security testing—maps its findings back to this list.

What does OWASP stand for?

OWASP stands for the Open Worldwide Application Security Project. The board renamed it from the Open Web Application Security Project in February 2023, dropping "Web" for "Worldwide" to reflect a scope that now covers mobile, API, cloud, and LLM security, not just browser-based applications.

OWASP is a nonprofit foundation founded in 2001 that produces free, vendor-neutral security standards through open community contributions. No vendor pays for placement in an OWASP list. Rankings are based on practitioner survey data, contributed vulnerability data, and community consensus.

Why the OWASP Mobile Top 10 matters

Mobile app security has no shortage of vendors, and each one has its own opinion of what matters most. The OWASP Mobile Top 10 exists so a developer, a CISO, and an auditor can work from the same list instead of three different ones.

That shared vocabulary is why the list keeps showing up everywhere else in the mobile security stack. MASVS structures its verification requirements around it. Compliance frameworks reference it. Procurement teams write it into RFPs.

A security program that cannot say where it stands against these ten categories has no way to answer the only question that actually matters: are we testing the right things?

The OWASP Mobile Top 10 (2024)

Each entry below defines the risk category itself: what it is, and why it earned its rank. For the specific ways attackers exploit each one, the exact prevention steps, and a CI/CD checklist, Appknox's pillar guide walks through all ten in full practitioner depth.

For exploit techniques, fixes, and a free checklist for each category,

See: The Complete Guide to OWASP Mobile Top 10

M1: Improper Credential Usage

Hardcoded API keys, credentials embedded in source or configuration files, and tokens stored or transmitted insecurely. This is the new top spot on the 2024 list, reflecting how often credential handling fails before any other control is even tested.

M2: Inadequate Supply Chain Security

Vulnerable or malicious components introduced through third-party SDKs, open-source libraries, and the build pipeline itself. This did not exist as its own top-10 entry in 2016. Its arrival at #2 reflects how much of a mobile binary is now assembled from code its own developers never wrote.

M3: Insecure Authentication/Authorization

OWASP M3 is about weak or missing authentication schemes that let an attacker execute app or backend functionality without proper authorization. Covers both client-side authentication bypass and server-side authorization checks that are missing or trust the client too much.

M4: Insufficient Input/Output Validation

Insufficient input/output validation addresses unsanitized data crossing a trust boundary, whether that boundary is a deep link, an API response, or user input, creating injection and manipulation risk.

M5: Insecure Communication

OWASP M5 talks about missing or broken TLS, certificate pinning failures, and cleartext transmission of sensitive data between the app and its backend. This category held the M3 spot in 2016 too. Encrypting data in transit has not gotten any easier over the past eight years.

M6: Inadequate Privacy Controls

Inadequate privacy controls is the collection, storage, or exposure of personal data beyond what the app discloses to the user. This is a new framing for 2024, driven directly by GDPR, CCPA, and the general tightening of global privacy regulation since 2016.

M7: Insufficient Binary Protections

Missing obfuscation, debuggable release builds, and weak anti-tampering or root/jailbreak detection make up insufficient binary protections. These are the properties that determine how easily an attacker can reverse-engineer or modify the compiled app.

M8: Security Misconfiguration

Insecure default permissions, exposed debug flags in production builds, and backend integrations configured with excessive trust constitute the OWASP M8 category of security misconfiguration.

M9: Insecure Data Storage

Insecure data storage comprises sensitive data, tokens, credentials, and personal data written to local storage, cache, or logs without adequate protection. This is a perennial entry: it held the #2 spot in 2016 and remains in the top 10 in 2024.

M10: Insufficient Cryptography

Insufficient cryptography is weak or broken encryption algorithms and improper key management. It held a top-10 spot in 2016 too, at M5. Its lower 2024 ranking doesn't mean the risk shrank, only that categories like credential usage and supply chain risk have overtaken it in relative frequency.

What changed between 2016 and 2024

OWASP calls the 2024 list its first major update to the Mobile Top 10 since 2016.

Three categories, Insecure Data Storage, Insecure Communication, and Insufficient Cryptography, kept their exact names across both lists, though their ranks moved. A fourth, Insecure Authentication, persisted and, in 2024, merged with 2016's separate Insecure Authorization category into a single Authentication/Authorization entry.

Four 2016 categories dropped out of the top 10 by name: Improper Platform Usage, Client Code Quality, Reverse Engineering, and Extraneous Functionality. None of these vanished as real risks. They were absorbed into broader categories (platform misuse and code-quality concerns now largely fall under Security Misconfiguration and Insufficient Binary Protections), or judged less differentiating in 2024 than they were in 2016, when reverse engineering read as a novel, mobile-specific concern rather than an assumed baseline.

Two categories are genuinely new framing. Inadequate Supply Chain Security and Inadequate Privacy Controls did not exist as named categories in 2016. Their arrival reflects two trends barely on the radar eight years ago: the sheer volume of third-party SDKs now compiled into a typical mobile binary, and the regulatory weight now attached to how apps handle personal data.

The full 2016 list, for reference

Improper Platform Usage, Insecure Data Storage, Insecure Communication, Insecure Authentication, Insufficient Cryptography, Insecure Authorization, Client Code Quality, Code Tampering, Reverse Engineering, Extraneous Functionality.

OWASP Mobile Top 10 vs MASVS

These two are often confused, and the confusion matters because they answer different questions.

The Mobile Top 10 answers: what should we be worried about? It's a risk-awareness list, ten broad categories ranked by how much damage they cause across the industry.

MASVS (the OWASP Mobile Application Security Verification Standard) answers: how do we verify we've addressed it?
MASVS translates each risk category into specific, testable requirements, organized into control groups, with defined verification levels:

• L1 for baseline security and
• L2 for defense-in-depth.

Improper Credential Usage and Insecure Authentication/Authorization, the first and third risks on the Mobile Top 10, both map to MASVS's authentication control group.

The OWASP Mobile Top 10 tells you where the risk is. MASVS tells you what a compliant control actually looks like.

Most mature compliance programs need both: the Top 10 to decide where testing effort goes, MASVS to define what passing actually means.

For the full verification framework, see: What is MASVS?

OWASP Mobile Top 10 vs OWASP Top 10 (Web)

Both lists come from OWASP. They are not the same list, and mapping one onto the other creates blind spots.

The web Top 10, most recently refreshed as the 2025 edition, is built around server-rendered applications, browser-based attack surfaces, and HTTP-level interactions: broken access control, injection, and, in the newest version, software supply chain failures in the build pipeline.

The Mobile Top 10 is built around a different artifact entirely: a compiled binary that ships to a device you don't control. Categories like Insufficient Binary Protections and on-device Insecure Data Storage have no direct web equivalent, because the web Top 10 has no concept of a binary an attacker can download and reverse-engineer.

Some concerns rhyme across both lists. Supply chain risk, authentication weakness, and misconfiguration show up in some form on each. But a mobile app reviewed only against the web Top 10 will pass an audit that never touched the compiled binary, which is exactly where most mobile-specific risk lives.

How the Mobile Top 10 maps to actual testing

A risk list only matters if something actually tests for it. Here's where each layer of testing picks up the ten categories:

• Binary SAST tests the compiled artifact for Insufficient Binary Protections (M7) and Security Misconfiguration (M8), and flags vulnerable or undisclosed components as part of Inadequate Supply Chain Security (M2).
• Real-device DAST executes the app to catch Insecure Communication (M5), Insecure Authentication/Authorization (M3), and Insecure Data Storage (M9) issues that only surface at runtime.
• API security testing targets the backend endpoints the app calls, covering the API-facing side of Improper Credential Usage (M1) and Insufficient Input/Output Validation (M4).
• SBOM, generated from the binary, gives Inadequate Supply Chain Security (M2) a concrete, queryable inventory instead of a hope that no SDK is compromised.

No single testing method covers all ten. That's the actual argument for combining binary SAST, real-device DAST, and API testing rather than picking one and calling the app covered.

Where Appknox fits

Appknox's Automated Vulnerability Assessment runs binary SAST, AI-led DAST on real iOS and Android devices, and API security testing in a single CI/CD-integrated scan, and maps every finding back to the OWASP Mobile Top 10 2024 category it falls under.
KnoxIQ then scores how exploitable each finding actually is in the specific app and device context. One exploitable finding can outweigh ten that aren't.

See the full testing methodology: Appknox Automated Vulnerability Assessment.

Frequently asked questions

What is the OWASP Mobile Top 10?

The OWASP Mobile Top 10 is a list published by OWASP that ranks the ten most critical security risks facing mobile applications. The current version, released in 2024, is the first major update since 2016.

Is the OWASP Mobile Top 10 the same as the OWASP Top 10?

No. The OWASP Top 10 covers web application risks. The OWASP Mobile Top 10 is a separate list maintained specifically for iOS and Android apps, covering risks such as binary protections and on-device data storage that have no direct web equivalents.

What changed between the 2016 and 2024 OWASP Mobile Top 10?

Four 2016 categories, Improper Platform Usage, Client Code Quality, Reverse Engineering, and Extraneous Functionality, were folded into broader categories or dropped. Inadequate Supply Chain Security and Inadequate Privacy Controls are new for 2024. Insecure Data Storage, Insecure Communication, and Insufficient Cryptography are the three categories that kept their names across both versions.

How does the OWASP Mobile Top 10 relate to MASVS?

The Mobile Top 10 identifies which risks matter most. MASVS (the Mobile Application Security Verification Standard) defines the specific, testable requirements for verifying that each risk has been addressed, organized into control groups with L1 and L2 verification levels.

Does Appknox test for all ten OWASP Mobile Top 10 categories?

Yes. Appknox's combination of binary SAST, real-device DAST, and API security testing covers all ten categories, and every finding is mapped back to the specific Mobile Top 10 category it falls under.

Where can I find exploit techniques and fixes for each OWASP Mobile Top 10 category?

This page defines each category. For the specific attack techniques, prevention steps, and a downloadable checklist for all ten, see Appknox's complete guide to the OWASP Mobile Top 10.

Related: The Complete Guide to OWASP Mobile Top 10 | What is MASVS? | What is MAST? | What is Binary-Based SAST? | Appknox Automated Vulnerability Assessment

By Aadarsh Anand, Security Researcher, Appknox Security Research Team

Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team, based on direct experience mapping findings from automated and manual testing to OWASP Mobile Top 10 and MASVS control requirements across financial services, healthcare, and enterprise mobile app portfolios.This page was drafted with AI assistance and reviewed and verified by the Appknox security research team.