What is the OWASP Mobile Top 10?
The OWASP Mobile Top 10 is a list of the ten most common mobile app security risk categories. It is not a full standard like MASVS; it is a widely used checklist that helps teams make sure they have covered the basics.
The ten categories
| Risk | In practice |
|---|---|
| M1 Improper Credential Usage | Keys and passwords hardcoded or handled carelessly. |
| M2 Inadequate Supply Chain Security | A bundled SDK brings in a flaw you did not write. |
| M3 Insecure Authentication / Authorization | Weak login or checks done on the phone, not the server. |
| M4 Insufficient Input / Output Validation | The app trusts data it should check. |
| M5 Insecure Communication | Traffic in clear or without proper certificate checks. |
| M6 Inadequate Privacy Controls | The app collects or shares more personal data than it should. |
| M7 Insufficient Binary Protections | No defence against tampering or reverse engineering where needed. |
| M8 Security Misconfiguration | Debug flags or default settings left on in production. |
| M9 Insecure Data Storage | Sensitive data written to the phone without protection. |
| M10 Insufficient Cryptography | Weak algorithms or crypto used the wrong way. |
How Mobexa covers the Mobile Top 10
Mobexa detects findings across all ten categories on the build you ship and tags each one, so you can see your exposure against the list at a glance. Every finding also maps to the deeper MASVS requirement behind it.
Common questions
Is the OWASP Mobile Top 10 a standard?
It is an awareness list, not a full standard. It highlights the most common risk categories. For a complete set of requirements, teams use the OWASP MASVS.
When was the Mobile Top 10 last updated?
The current list is the 2024 edition. Mobexa maps findings to these categories and to the underlying MASVS controls.
Mobexa maps every finding on your Android and iOS builds to OWASP Mobile Top 10 and the other standards an auditor recognises.
Start Free Trial