Systematic Hybrid Analysis of Android Applications: CWE-Categorized Vulnerabilities and Practical Mitigation Strategies

Android applications are the backbone of contemporary communication, commercial, and day-to-day operations, but their complexity makes them prone to many types of security risks. This paper utilizes the systematic approach, where vulnerabilities will be reviewed in an organized, replicable, and traceable fashion. Moreover, this research paper will follow a hybrid approach, incorporating both static and dynamic analysis using the Mobile Security Framework on a Genymotion virtual environment. Contrary to previous research streams, this research will conduct a complete comparative analysis of the results obtained from the static as well as dynamic tests, which will align with the systematic framework of Common Weakness Enumeration. Static results showed that there were many vulnerabilities, such as excessive user permissions and weak certificates, as well as cleartext handling, whereas the dynamic test showed many risks, such as bypassing the certificate pinning, handling lifecycles, and user privilege manipulation. To overcome these types of vulnerabilities, this research will conduct an in-depth discussion on various techniques, such as certificate pinning, securing data, and reducing permissions, as well as securing lifecycles. Furthermore, taxonomy and CIA impact calculations have been formalized through set-based equations, strengthening the reproducibility and comparative scope of this study.