Android App Links let apps claim ownership of HTTPS domains so that links to those domains open directly in the app instead of showing a browser or a chooser. The claim becomes authoritative when t...

React Native apps have a JavaScript runtime and a native runtime, with a bridge between them. The bridge is enumerable - apps expose a collection of NativeModules that JavaScript can call. Each mod...

CVE-2017-13156 (Janus) lets an attacker prepend a malicious DEX to an APK and have the system execute the prepended DEX while the v1 signature still verifies. v1 signs files inside the ZIP, not the...

Log.d, Log.v, Log.i calls in production builds dump strings to logcat. On Android 4.1+ the READ_LOGS permission is signature-only, so a regular third-party app cannot read another app’s logs. But a...

Class.forName(intent.getStringExtra("class_name")) is one step short of the dynamic-code-loading bug. The attacker cannot supply new code, but they can pick which existing class on the app’s classp...

Apps that load code at runtime from outside the APK - via DexClassLoader, PathClassLoader, or InMemoryDexClassLoader - are common in plugin architectures, dynamic feature modules, and hot-patch fra...

Android displays the posting app’s name and icon alongside every notification - you cannot lie about which app sent it. What you can control is the content: title, body, channel name, and what happ...

Android manages activities in stacks called tasks. Each task has a taskAffinity — a string that determines which task an activity belongs to. When no taskAffinity is declared on an activity, Androi...

network_security_config.xml is Android’s declarative way to control TLS trust. From API 24, Android stopped trusting user-installed CAs by default - apps had to explicitly opt in. That protection d...

A HostnameVerifier that returns true unconditionally means TLS connections accept any hostname as long as the certificate is valid for some hostname. A network attacker with a Let’s Encrypt cert fo...