v2.0.0 Release Notes

This release spans January – June 2026 and marks the official completion of the MASTG v2 refactor — a multi-year effort to modularize the guide into individually referenceable, machine-readable components with structured metadata, automated demos, and full cross-linking across MASVS, MASWE, tests, techniques, tools, and best practices. v2.0.0 is the first stable, non-beta release of the new framework.

MASTG v2 couldn't have been completed without the tireless contributions of the MAS Task Force and our MAS Advocates. We'd like to thank them for their dedication, technical expertise, and commitment to improving mobile app security for the entire community. Their contributions have been invaluable in shaping the MASTG into a comprehensive and practical resource for mobile app security testing.

Special thanks to:

• NowSecure (via @cpholguera), who celebrates 4 years of MAS Advocate contributions.
• Guardsquare (via @serek8), who celebrates 2 years of MAS Advocate contributions.
• Vulnit, who earned the OWASP MAS Advocate status with their first major contribution wave in the first half of 2026.
  • In over 6 months, @jacobocasado and @sgIOlas ported several v1 tests — focused on the technically demanding MASVS-RESILIENCE category (anti-debugging, obfuscation, emulator/simulator detection, RE tool detection, IPC) — producing 17 new atomic v2 tests and 16 runnable demos.
  • Beyond porting, they consistently performed in-depth technical reviews: restructuring test pairs, converting tests from static to dynamic, adding Frida demos with verified device output.
  • Their participation in the MAS Task Force working group has been invaluable, and their contributions are now fully integrated into the MASTG v2 release.

Would you like to become an OWASP MAS Advocate? Learn more about the program and how to get involved at mas.owasp.org.

The first OWASP MAScon: a dedicated mobile app security conference co-located with OWASP Global AppSec EU 2026 in Vienna on June 25, organized by Carlos Holguera (@cpholguera) and Sven Schleier (@sushi2k), with speakers including Jan Seredynski (Guardsquare; @serek8), Jeroen Beckers (NVISO; @TheDauntless), Sergi Alvarez (pancake / radare2, NowSecure; @trufae), and Ole André Vadla Ravnås (Frida, NowSecure; @oleavr), and Stefan Bernhardsgrütter (redguard; @bernhste).

Given the success of this first conference, the MAS project is now planning a second MAScon in October 2026 in Berlin, co-located with droidCon.

MASTG v2

We began the refactoring process in 2021, focusing first on the MASVS and then on the MASTG. Our primary goal was to break the MASTG v1 into modular components, including tests, techniques, tools, and applications.

This modular approach allows us to maintain and update each component independently, ensuring that the MASTG remains current and relevant. For example, in our previous structure, the MASTG consisted of large test cases within a single markdown file. This was not only difficult to maintain but also made it challenging to reference specific tests, and it was impossible to have metadata for each test.

The new structure divides tests into individual pages (Markdown files with metadata), each with its own ID (MASTG-TEST-****) and links to relevant techniques (MASTG-TECH-****) and tools (MASTG-TOOL-****). This encapsulation ensures that each test is easily referenced and promotes reusability across all MAS components. For example, you can open a test and see what tools and techniques are being used, and soon you'll be able to do the same in reverse: open a tool or technique and see all the tests that use it. This deep cross-referencing can be extremely powerful when exploring the MASTG.

Now MASVS, MASWE, and MASTG are all seamlessly connected. We start with the high-level requirements, zoom in on the specific weaknesses, and then go low-level to the tests and hands-on with the demos. Here's how it works:

1. MASVS Controls: High-level platform-agnostic requirements.

   For example, "The app employs current cryptography and uses it according to best practices." (MASVS-CRYPTO-1).

2. MASWE Weaknesses: Specific weaknesses, typically also platform-agnostic, related to the controls.

   For example, "use of predictable pseudo-random number generation" (MASWE-0027).

3. MASTG Tests: Each weakness is evaluated by executing tests that guide the tester in identifying and mitigating the issues using various tools and techniques on each mobile platform.

   For example, testing for "insecure random API usage on Android" (MASTG-TEST-0204).
   Tests are backed by knowledge articles (MASTG-KNOW-****) and best practices (MASTG-BEST-****) that provide additional context and guidance for testers.
   They use techniques (MASTG-TECH-****) to perform the test steps.

4. MASTG Demos: Practical demonstrations that include working code samples and test scripts to ensure reproducibility and reliability.

   For example, a sample using Java's Random() instead of SecureRandom() (MASTG-DEMO-0007).
   Demos use specific tools (MASTG-TOOL-****) to perform the test steps.

📊 By the Numbers

| Component | New in v2.0.0 | Total |
| --- | --- | --- |
| Tests | +77 | 193 |
| Demos | +72 | 152 |
| Techniques | +34 | 167 |
| Knowledge Articles | +34 | 140 |
| Best Practices | +45 | 72 |
| Tools | +9 | 135 |
| Total | +271 | ~860 |

Note: Each port of a v1 test typically creates multiple v2 atomic tests and multiple runnable demos. For example, the port of MASTG-TEST-0018 (Biometric Authentication) produced 5 atomic tests and 5 demos; the port of MASTG-TEST-0026 (Implicit Intents) produced 4 tests and 6 demos. The 40+ v1 test ports in this release alone account for most of the +271 new components.

📢 News

• First OWASP MAScon announced — dedicated mobile app security conference at OWASP Global AppSec EU 2026, Vienna, June 25–26 — mas.owasp.org/news

🧪 MASTG Tests

This release completes the largest single wave of v1→v2 test ports. Each v1 test produced one or more atomic v2 tests and demos, shown below. Ports are grouped by contributing organization.

All v1 tests are still available for a limited time on our website (click on "Show Deprecated"), but are no longer maintained. The v2 tests are now the canonical reference for OWASP MAS testing. When opening a deprecated v1 test, a banner will link to the corresponding v2 tests.

v1 → v2 Ports (by @NowSecure)

Port MASTG-TEST-0018 — Testing Biometric Authentication by @cpholguera with @Copilot — #3560

→ MASTG-TEST-0326 · MASTG-TEST-0327 · MASTG-TEST-0328 · MASTG-TEST-0329 · MASTG-TEST-0330
→ MASTG-DEMO-0089 · MASTG-DEMO-0090 · MASTG-DEMO-0091 · MASTG-DEMO-0092 · MASTG-DEMO-0093

Port MASTG-TEST-0065 — Testing Data Encryption on the Network (ios) by @cpholguera with @Copilot — #3564

→ MASTG-TEST-0321 · MASTG-TEST-0322 · MASTG-TEST-0323
→ MASTG-DEMO-0083 · MASTG-DEMO-0084 · MASTG-DEMO-0085 · MASTG-DEMO-0086

Port MASTG-TEST-0066 — Testing TLS Settings (ios) by @cpholguera with @Copilot — #3792

→ MASTG-TEST-0342 · MASTG-TEST-0343 · MASTG-TEST-0344 · MASTG-TEST-0345
→ MASTG-DEMO-0109 · MASTG-DEMO-0110 · MASTG-DEMO-0111
→ MASTG-BEST-0042 · MASTG-BEST-0043 · MASTG-TECH-0149

Port MASTG-TEST-0067 — Testing Endpoint Identity Verification (ios) by @cpholguera with @Copilot — #3522; updated (pending merge) by @cpholguera — #3880

→ MASTG-TEST-0322 · MASTG-TEST-0342 (shared with 0065/0066 ports)

Port MASTG-TEST-0068 — Testing Certificate Pinning (ios) by @cpholguera with @Copilot — #3732

→ MASTG-TEST-0385
→ MASTG-DEMO-0148

Port MASTG-TEST-0070 — Testing Universal Links (ios) by @cpholguera — #3904

→ MASTG-TEST-0395
→ MASTG-DEMO-0153

Port MASTG-TEST-0071 — Testing UIActivity Sharing (ios) by @cpholguera with @Copilot — #3780

→ MASTG-TECH-0167 · MASTG-TECH-0168 (new iOS techniques)

Port MASTG-TEST-0072 — Testing App Extensions (ios) by @cpholguera with @Copilot — #3523

→ MASTG-TEST-0388 · MASTG-TEST-0389 · MASTG-TEST-0390

Port MASTG-TEST-0077 — Testing WebView Protocol Handlers (ios) by @cpholguera with @Copilot — #3591

→ MASTG-TEST-0335 · MASTG-TEST-0336
→ MASTG-DEMO-0098 · MASTG-DEMO-0099

Port MASTG-TEST-0079 — Testing Object Persistence (ios) by @cpholguera with @Copilot — #3561

→ MASTG-TEST-0386
→ MASTG-DEMO-0149

Port MASTG-TEST-0084 — Testing Verbose Error Logging (ios) by @cpholguera with @Copilot — #3587

→ MASTG-TEST-0358 · MASTG-TEST-0359
→ MASTG-DEMO-0124 · MASTG-DEMO-0125

Port MASTG-TEST-0028 — Testing Deep Links (android) by @cpholguera — #3897

→ MASTG-TEST-0393 · MASTG-TEST-0394
→ MASTG-DEMO-0151 · MASTG-DEMO-0152

Port MASTG-TEST-0030 — Testing PendingIntent (android) by @cpholguera with @Copilot — #3562

→ MASTG-TEST-0381
→ MASTG-DEMO-0147

Port MASTG-TEST-0035 — Testing Android Overlay Attack Protections by @cpholguera with @Copilot — #3649

→ MASTG-TEST-0340
→ MASTG-DEMO-0103 · MASTG-DEMO-0104 · MASTG-DEMO-0105

Port MASTG-TEST-0036 + MASTG-TEST-0080 — Testing Enforced Updating (android + ios) by @TheDauntless — #3048

→ MASTG-TEST-0382 (android) · MASTG-TEST-0383 (ios) · MASTG-TEST-0384 (ios)

Port MASTG-TEST-0045 — Testing Root Detection (android) by @cpholguera with @Copilot — #3604

→ MASTG-TEST-0324 · MASTG-TEST-0325
→ MASTG-DEMO-0087 · MASTG-DEMO-0088

Port MASTG-TEST-0047 — Testing File Integrity Checks (android) by @cpholguera — #3879

→ MASTG-TEST-0338 (References to Storage Integrity Check APIs)

Port MASTG-TEST-0048 — Testing Reverse Engineering Tools Detection (android) by @cpholguera — #3825

→ MASTG-TEST-0341 (Runtime Integrity Checks)

Port MASTG-TEST-0067 — Testing Endpoint Identity Verification (ios) (pending merge, update) by @cpholguera — #3880

Port MASTG-TEST-0056 — Sensitive Data via IPC Mechanisms (ios) by @cpholguera with @Copilot — #3793

→ MASTG-KNOW-0104 · MASTG-KNOW-0122–0128 (7 new iOS platform knowledge articles)
→ MASTG-BEST-0045

v1 → v2 Ports (by @Guardsquare)

Port MASTG-TEST-0076 — Testing iOS WebViews by @serek8 — #3608

→ MASTG-TEST-0331 · MASTG-TEST-0332 · MASTG-TEST-0333
→ MASTG-DEMO-0094 · MASTG-DEMO-0095 · MASTG-DEMO-0096

Port MASTG-TEST-0026 — Testing Implicit Intents (android) by @serek8 — #3807

→ MASTG-TEST-0372 · MASTG-TEST-0373 · MASTG-TEST-0374 · MASTG-TEST-0375
→ MASTG-DEMO-0136 · MASTG-DEMO-0137 · MASTG-DEMO-0138 · MASTG-DEMO-0139 · MASTG-DEMO-0140 · MASTG-DEMO-0141

Port MASTG-TEST-0075 — Testing Custom URL Schemes (ios) (by @Guardsquare) by @cpholguera with @Copilot — #3826

→ MASTG-TEST-0370 (Missing Input Validation in Custom URL Scheme Handlers) · MASTG-TEST-0371 (Missing Source Validation in Custom URL Scheme Handlers)
→ MASTG-DEMO-0134 · MASTG-DEMO-0135

Port MASTG-TEST-0078 — Native Methods Exposed Through WebViews (ios) (by @Guardsquare) by @cpholguera with @Copilot — #3779

→ MASTG-TEST-0376 · MASTG-TEST-0377 · MASTG-TEST-0378 · MASTG-TEST-0379 · MASTG-TEST-0380
→ MASTG-DEMO-0142 · MASTG-DEMO-0143 · MASTG-DEMO-0144 · MASTG-DEMO-0145 · MASTG-DEMO-0146

Port MASTG-TEST-0027 — Testing URL Loading in WebViews by @serek8 — #3570

→ MASTG-TEST-0398 · MASTG-TEST-0399 · MASTG-TEST-0400
→ MASTG-DEMO-0156 · MASTG-DEMO-0157 · MASTG-DEMO-0158

v1 → v2 Ports (by @Vulnit)

Port MASTG-TEST-0046 — Testing Anti-Debugging Detection (android) by @sgIOlas — #3699

→ MASTG-TEST-0352 (References to Debugging Detection APIs) · MASTG-TEST-0353 (Runtime Use of Debugging Detection APIs)
→ MASTG-DEMO-0115 · MASTG-DEMO-0116

Port MASTG-TEST-0049 — Testing Emulator Detection (android) by @jacobocasado — #3607

→ MASTG-TEST-0351
→ MASTG-DEMO-0114

Port MASTG-TEST-0051 — Testing Obfuscation (android) (by @Vulnit and @NowSecure) by @jacobocasado — #3770

→ MASTG-TEST-0368 · MASTG-TEST-0369
→ MASTG-DEMO-0132 · MASTG-DEMO-0133

Port MASTG-TEST-0057 — Sensitive Data in Text Input Fields (ios) by @cpholguera with @Copilot — #3778

→ MASTG-TEST-0346 · MASTG-TEST-0347
→ MASTG-DEMO-0112 · MASTG-DEMO-0113

Port MASTG-TEST-0092 — Testing Simulator Checks (ios) by @jacobocasado — #3737

→ MASTG-TEST-0367
→ MASTG-DEMO-0131

Port MASTG-TEST-0093 — Testing Obfuscation (ios) by @jacobocasado — #3901

→ MASTG-TEST-0391

Port MASTG-TEST-0091 — Reverse Engineering Tools Detection (ios) (by @Vulnit) by @cpholguera with @Copilot — #3823

→ MASTG-TEST-0354
→ MASTG-DEMO-0117 · MASTG-DEMO-0118 · MASTG-DEMO-0119

Port MASTG-TEST-0069 — App Permissions and Entitlements (ios) (by @Vulnit and @NowSecure) by @cpholguera with @Copilot — #3563

→ MASTG-TEST-0360 · MASTG-TEST-0361 · MASTG-TEST-0362 · MASTG-TEST-0363
→ MASTG-DEMO-0126 · MASTG-DEMO-0127

Port MASTG-TEST-0051 (cont.) — Testing Obfuscation (android) (by @Vulnit and @NowSecure) — see also #3842 for the related IPC test:

Port MASTG-TEST-0029 — Sensitive Functionality Exposure Through IPC (android) (by @Vulnit and @NowSecure) by @cpholguera — #3842

→ MASTG-TEST-0364 · MASTG-TEST-0365 · MASTG-TEST-0366
→ MASTG-DEMO-0128 · MASTG-DEMO-0129 · MASTG-DEMO-0130

Port MASTG-TEST-0089 — Testing Anti-Debugging Detection (ios) (by @Vulnit) by @sgIOlas — #3907

→ MASTG-TEST-0401 · MASTG-TEST-0402

v1 → v2 Ports (by other Task Force members)

Port MASTG-TEST-0033 — Testing Java Objects Exposed Through WebViews (android) by @Diolor — #3494

→ MASTG-TEST-0334
→ MASTG-DEMO-0097

Port MASTG-TEST-0037 — Testing WebViews Cleanup (android) by @Diolor — #3558

→ MASTG-TEST-0320
→ MASTG-DEMO-0082

Port MASTG-TEST-0050 — Testing Runtime Integrity Checks (android) by @Diolor — #3692

→ MASTG-TEST-0341
→ MASTG-DEMO-0106 · MASTG-DEMO-0107 · MASTG-DEMO-0108

Port MASTG-TEST-0090 — Testing File Integrity Checks (ios) by @Diolor — #3871

→ MASTG-TEST-0338

Port MASTG-TEST-0034 — Testing Object Persistence (android) by @sk3l10x1ng — #3672

→ MASTG-TEST-0337
→ MASTG-DEMO-0100

Port MASTG-TEST-0025 — Testing Injection Flaws (android) by @ScreaMy7 — #3424

→ MASTG-TEST-0339
→ MASTG-DEMO-0102

Port MASTG-TEST-0002 — Testing Local Storage for Input Validation (android) by @jeel38 — #3328

→ MASTG-TEST-0338
→ MASTG-DEMO-0101

New Tests & Updates

• MASTG-TEST-0287 (new, from MASTG-KNOW-0036) by @cpholguera — #3706
• MASTG-TEST-0355, 0356, 0357: enhanced with Example Attack Scenarios and further validation by @cpholguera — #3850
• MASTG-TEST-0007: Sensitive Stored Data via IPC (android) by @sushi2k — #3849
• Review implicit intents content by @jacobocasado — #3883

Consistency & Format

• Consistent wording across all v2 tests by @Diolor — #3559
• Consistent observation sections by @Diolor — #3760
• Consistent evaluation sections by @Diolor — #3761

🎬 MASTG Demos

72 new demos were added in this release, almost entirely as part of the v1→v2 port work above (each port PR delivered 1–6 runnable demos). Notable standalone demo work:

• Migrate dynamic demos to frooky (structured Frida DAST) by @Diolor — #3645
• Refactor iOS WebView demos MASTG-DEMO-0095 and MASTG-DEMO-0096 by @cpholguera — #3753
• Add attacker app for MASTG-DEMO-0122 by @cpholguera — #3851
• Update evaluation for demo instructions by @cpholguera — #3757
• Update demo instructions: additional file types and customization details for Android and iOS by @cpholguera — #3854

🛡️ MASTG Best Practices

45 new best practices were added in this release, primarily as support for the ported tests:

• MASTG-BEST-0012: JavaScript in WebViews (updated) by @cpholguera — #3746
• MASTG-BEST-0031 and new best practices 0032–0035 for biometric auth tests 0326–0330 by @cpholguera with @Copilot — #3749
• MASTG-BEST-0042, MASTG-BEST-0043 (TLS) created with TEST-0066 port — #3792
• MASTG-BEST-0045 (iOS IPC source validation) created with TEST-0056 port — #3793

📖 MASTG Knowledge

34 new knowledge articles were added in this release:

• 7 new iOS platform articles (MASTG-KNOW-0104, 0122–0128) created with the TEST-0056 port (iOS IPC) by @cpholguera — #3793
• MASTG-KNOW-0001 (Android Biometrics): fully revised by @cpholguera with @Copilot — #3749
• MASTG-KNOW-0017: Android 17 permissions added by @KVVat — #3844; risk category for BIND_ACCESSIBILITY_SERVICE by @annab-google — #3743
• MASTG-KNOW-0030, MASTG-KNOW-0032 updated by @cpholguera — #3790
• MASTG-KNOW-0036 updated, MASTG-TEST-0287 implemented by @cpholguera — #3706
• MASTG-KNOW-0081 (iOS Pasteboard): updated with TEST-0071 port by @cpholguera — #3780
• Split generic 0x04c chapter into standalone MASTG-KNOW articles by @cpholguera with @Copilot — #3727
• Add Android Enterprise section to Platform Overview by @cpholguera with @Copilot — #3640
• Add Android Device Security Database reference by @Diolor — #3647
• Mark Xamarin as end of support by @viso27 — #3725

✨ MASTG Techniques

34 new techniques were added in this release:

• [MASTG-TECH-0147] iOS Patching by @cpholguera with @Copilot — #3654
• [MASTG-TECH-0149] iOS TLS analysis technique, created with TEST-0066 port by @cpholguera with @Copilot — #3792
• [MASTG-TECH-0167] + [MASTG-TECH-0168] UIActivity analysis techniques, created with TEST-0071 port — #3780
• Split library techniques into static (bundled) and dynamic (loaded) for Android and iOS (by @Vulnit) by @cpholguera with @Copilot — #3789
• Add apkeep tool and XAPK conversion technique by @cpholguera with @Copilot — #3697
• Add detailed Radare2 usage for iOS static analysis by @cpholguera — #3290
• Restore techniques for non-jailbroken / non-rooted devices; update MASTG-TECH-0026 by @cpholguera — #3726
• Replace deprecated Android Device Monitor references with Android Studio Profiler by @cpholguera with @Copilot — #3639
• TLS 1.0/1.1 on iOS by @sushi2k — #3813
• Add Frida Handbook references to techniques by @cpholguera with @Copilot — #3653
• [MASTG-TECH-0112] (Flutter RE): fix ID by @cpholguera — #3841
• Fix grammar in iOS MASTG-TECH by @Diolor — #3594

🪄 MASTG Tools

New tools:

• [MASTG-TOOL-0150] xpcspy — iOS XPC message interception by @cpholguera — #3794
• [MASTG-TOOL-0149] LSPosed — modern Xposed successor for Android by @TheDauntless — #3705

Updates:

• Frida 17: clarify breaking changes and installation of runtime bridges by @cpholguera — #3627
• Frida 17: update Frida script instructions by @cpholguera — #3678
• Add Interceptor support for native method hooking in Frida utils by @cpholguera with @Copilot — #3557

Deprecations:

• MASTG-TOOL-0008, MASTG-TOOL-0027, MASTG-TOOL-0051 deprecated; replaced by MASTG-TOOL-0149 (LSPosed) by @TheDauntless — #3705

⚡ Automation

• AI Moderator workflow for spam detection by @cpholguera — #3628, #3629
• Issue Assignment Bot by @cpholguera — #3659, #3664, #3681
• Reuse iOS build scripts from the iOS repo by @Diolor — #3601
• Fix iOS build by @cpholguera — #3722
• Fix: skip build job when demo matrix is empty by @Diolor — #3736
• Fix iOS path and update dependencies by @Diolor — #3815
• Add build block to Android demo workflow by @cpholguera — #3853
• URL checker fixes by @Diolor — #3688, #3690
• Apply linter on Copilot instruction files by @Diolor — #3655
• Security: fix for possible workflow injection by @sushi2k — #3784
• Security: fix incomplete URL substring sanitization by @cpholguera — #3618

🐞 Errata Corrections

• Markdown consistency and errata sweep by @Diolor — #3650
• Fix TECH ID in MASTG-TEST-0320 steps by @Diolor — #3677
• Fix incorrect information on mutability of Pending Intents by @mateofumis — #3762

New Contributors

• @sgIOlas — #3699
• @mateofumis — #3762

Full Changelog: v1.9.0...v2.0.0