Posted on by Achim D. Brucker, licensed under CC BY-ND 4.0.

The Security Risks of Hybrid Mobile Apps

Cross-platform frameworks, such as Apache Cordova, are becoming increasingly popular. They promote the development of hybrid apps that combine native, i.e., system specific, code and system independent code, e.g., HTML5/JavaScript. Combining native with platform independent code opens Pandora’s box: all the the security risks for native development are multiplied with the security risk of web applications.

If you want to learn more, visit our talk at the OWASP AppSecEU in Belfast. Update: you can also watch the recording of our talk!.

In the first half of our talk, we start our talk with short introduction into hybrid app development, present specific attacks followed by a report on how Android developers are using Apache Cordova. In the second half of the talk, we will focus on developing secure hybrid apps: both with hands-on guidelines for defensive programming as well as recommendations for hybrid app specific security testing strategies.

Supplementary Material


1. Brucker, A. D. and Herzberg, M. “On the Static Analysis of Hybrid Mobile Apps: A Report on the State of Apache Cordova NationInternational symposium on engineering secure software and systems (essos) (2016): 72–88. doi:10.1007/978-3-319-30806-7_5, URL: