The first stable release of the OWASP Mobile Application Security Weakness Enumeration:
Every weakness is now fully written, consistently structured, stably numbered, and connected to a shared threat and attack model. There are no placeholders and no drafts left in the catalogue.
Important
This release renumbers every weakness: If you reference MASWE IDs please use the following mappings for any migrations (see maswe-beta key). This is a one-time event: from v1.0.0 onward, IDs are stable and are never reused, renumbered, or recycled.
What's new
Read the announcement blog post.
Consolidation: 119 → 78 weaknesses
The beta had grown organically and contained large families of near-identical entries — nine variants of "unsafe handling of data from X", ten variants of missing authentication on different app component types. These were merged into single, properly scoped weaknesses.
- 72 weaknesses were renamed and rescoped.
- 47 were absorbed into other weaknesses.
- 6 are brand new.
| Category | Count | ID range |
|---|---|---|
| MASVS-STORAGE | 6 | MASWE-0001–0006 |
| MASVS-CRYPTO | 11 | MASWE-0007–0017 |
| MASVS-AUTH | 8 | MASWE-0018–0025 |
| MASVS-NETWORK | 3 | MASWE-0026–0028 |
| MASVS-PLATFORM | 12 | MASWE-0029–0040 |
| MASVS-CODE | 10 | MASWE-0041–0050 |
| MASVS-RESILIENCE | 15 | MASWE-0051–0065 |
| MASVS-PRIVACY | 13 | MASWE-0066–0078 |
IDs now run MASWE-0001 through MASWE-0078 with no gaps, grouped into one contiguous block per MASVS category in the canonical order STORAGE → CRYPTO → AUTH → NETWORK → PLATFORM → CODE → RESILIENCE → PRIVACY. Within a block, weaknesses are ordered by their first MASVS control.
Note that future IDs will not necessarily be consecutive. New weaknesses take the next free number regardless of category, so that existing IDs never have to move again.
While most of the MASWEs remain or have been merged into other MASWEs, others are completely new:
| ID | Title |
|---|---|
| MASWE-0040 | Sensitive Data Leaked via Accessibility Services |
| MASWE-0048 | Malicious Code Included in the App |
| MASWE-0051 | Root/Jailbreak Detection Not Implemented |
| MASWE-0055 | Malware Detection Not Implemented |
| MASWE-0069 | Usage of Non-Privacy-Preserving Functionality |
| MASWE-0075 | Non-Reproducible Builds (classified under MASVS-PRIVACY-3 as a build-transparency weakness) |
Standardized page structure
Every weakness now has exactly four sections, in this order:
## Overview— opens with a one-sentence definition in the form "This weakness occurs when …".## Modes of Introduction— only developer-introduced, testable causes. Each bullet starts with a bold short label.## Impact— only consequences. Each bullet opens with a canonical label and closes with a resulting in clause.## Mitigations— actionable, imperative instructions to a developer. Each bullet starts with a bold short label.
Impact labels come from a fixed vocabulary in .github/instructions/impact.yaml, so equivalent consequences use identical wording across all 78 weaknesses:
Compromise of Sensitive Data · Authentication or Authorization Bypass · Bypass of Protection Mechanisms · Execution of Unauthorized Code · Financial Loss · Compromise of System Integrity and Business Operations · Violation of User Privacy · Loss of User Trust · Legal and Regulatory Non-Compliance · Compromise of Content or UI Integrity
Content is also platform-agnostic by default. Platform APIs appear only as clarifying examples where they genuinely aid understanding; platform-specific depth belongs in the MASTG.
For more details, read the announcement blog post.
Acknowledgements
This release came out of a single 186-file pull request that collected 500 inline review comments. Thank you to everyone in the OWASP MAS Task Force who worked through it, in alphabetical order:
- Dionysis Lorentzos — @diolor
- Jacobo Casado — @jacobocasado
- Jan Seredynski — @serek8
- Jeroen Beckers — @TheDauntless
- Sergio García — @sgIOlas
- Stefan Bernhardsgrütter — @bernhste
- Sven Schleier — @sushi2k
Special thanks to Carlos Holguera (@cpholguera) for driving the remapping, the consolidation, and the authoring standard that made a catalogue of this size internally consistent.
Thank you as well to everyone in the wider community who filed issues, opened discussions, or told us in person that a particular weakness did not make sense. Many of the merges in this release started as someone pointing out that two pages were saying the same thing.
And thank you to our MAS Advocates for their continuous contributions: NowSecure, Guardsquare, and vulnit.