---
layout: col-sidebar
title: OWASP Mobile Top 10
tags: acknowledgements-tag controls-tag
level: 3
type: documentation
---
# Mobile Top 10 2024: Final Release Updates
The new Mobile Top 10 list for 2024 is out now.
We would love to see you participate and contribute to the research we are doing.
[Join the SLACK Channel](https://app.slack.com/client/T04T40NHX/C02L2BNTBLP)
If you face any issues joining us on Slack, please feel free to reach out to Project Leads.
Let's get started!
Join us on the Slack channel for contributions!!
More updates to follow soon...
Below is the OWASP Mobile Top-10 2024 Release
# Top 10 Mobile Risks - Final release 2024
- [M1: Improper Credential Usage](2023-risks/m1-improper-credential-usage.md)
- [M2: Inadequate Supply Chain Security](2023-risks/m2-inadequate-supply-chain-security.md)
- [M3: Insecure Authentication/Authorization](2023-risks/m3-insecure-authentication-authorization.md)
- [M4: Insufficient Input/Output Validation](2023-risks/m4-insufficient-input-output-validation.md)
- [M5: Insecure Communication](2023-risks/m5-insecure-communication.md)
- [M6: Inadequate Privacy Controls](2023-risks/m6-inadequate-privacy-controls.md)
- [M7: Insufficient Binary Protections](2023-risks/m7-insufficient-binary-protection.md)
- [M8: Security Misconfiguration](2023-risks/m8-security-misconfiguration.md)
- [M9: Insecure Data Storage](2023-risks/m9-insecure-data-storage.md)
- [M10: Insufficient Cryptography](2023-risks/m10-insufficient-cryptography.md)
## Comparison between 2016 and 2024
## Vulnerabilities that didn't make the place on the initial release list, but in the future, we may consider them.
* Data Leakage
* Hardcoded Secrets
* Insecure Access Control
* Path Overwrite and Path Traversal
* Unprotected Endpoints (Deeplink, Activity, Service ...)
* Unsafe Sharing
# Top 10 Mobile Risks - Final List 2016
- [M1: Improper Platform Usage](2016-risks/m1-improper-platform-usage)
- [M2: Insecure Data Storage](2016-risks/m2-insecure-data-storage)
- [M3: Insecure Communication](2016-risks/m3-insecure-communication)
- [M4: Insecure Authentication](2016-risks/m4-insecure-authentication)
- [M5: Insufficient Cryptography](2016-risks/m5-insufficient-cryptography)
- [M6: Insecure Authorization](2016-risks/m6-insecure-authorization)
- [M7: Client Code Quality](2016-risks/m7-client-code-quality)
- [M8: Code Tampering](2016-risks/m8-code-tampering)
- [M9: Reverse Engineering](2016-risks/m9-reverse-engineering)
- [M10: Extraneous Functionality](2016-risks/m10-extraneous-functionality)
# Top 10 Mobile Risks - Final List 2014
- [M1: Weak Server Side Controls](2014-risks/m1-weak-server-side-controls)
- [M2: Insecure Data Storage](2014-risks/m2-insecure-data-storage)
- [M3: Insufficient Transport Layer Protection](2014-risks/m3-insufficient-transport-layer-protection)
- [M4: Unintended Data Leakage](2014-risks/m4-unintended-data-leakage)
- [M5: Poor Authorization and Authentication](2014-risks/m5-poor-authorization-and-authentication)
- [M6: Broken Cryptography](2014-risks/m6-broken-cryptography)
- [M7: Client Side Injection](2014-risks/m7-client-side-injection)
- [M8: Security Decisions Via Untrusted Inputs](2014-risks/m8-security-decisions-via-untrusted-inputs)
- [M9: Improper Session Handling](2014-risks/m9-improper-session-handling)
- [M10: Lack of Binary Protections](2014-risks/m10-lack-of-binary-protections)