Skip to content
AI Security

Lesson 3 of 6 · 7 min read

Mobile IPC, Deep Links and WebViews as Attack Surface

Mobile apps expose entry points that other apps and web pages can reach: Android activities, services, receivers and content providers; deep links and custom URL schemes on both platforms; and WebViews with JavaScript bridges into native code. Each is an API with an untrusted caller. Typical bugs are missing authorization on exported components, intent redirection where the app forwards attacker intents with its own identity, content-provider path traversal, custom schemes claimed by malicious apps to steal OAuth codes, deep links that perform actions without confirmation, and WebView bridges reachable from untrusted pages. Fixes are the API-security basics applied on the phone: minimal exposure, verified identity, validated input and explicit confirmation.

Reviewed By the AISecurityInterviews editorial team
free sign-in, no card required

Practise it as an interviewer asks it

Mobile Application SecurityCompare the Android and iOS security models. What does each platform guarantee an app, and what does it not?Systems, OS & Memory SafetyWhat is a process from a security point of view, and what stops one process from reading another's memory?Mobile Application SecurityHow does the Android application sandbox work, and what role do app signing and permissions play?Mobile Application SecurityWhat are OWASP MASVS and MASTG, and how would you use them to scope a mobile app assessment?Mobile Application SecurityHow should a mobile app store tokens and keys on Android and iOS, and what does hardware-backed storage really protect?Mobile Application SecurityWhat are exported components on Android, and how do insecure intents and content providers lead to vulnerabilities?

Related lessons

The Mobile Platform Security ModelThe Confused DeputyOAuth 2.0 and PKCECross-Site Scripting and Output Encoding