Whether off-the-shelf Large Language Models (LLMs) can effectively reason about taint flows in Android apps is investigated, and preliminary findings suggest that LLM reasoning may effectively complement traditional static taint analysis.
Abstract
Taint analysis is a fundamental technique for detecting sensitive data leaks in Android apps. However, traditional static tools, such as FlowDroid, still face well-known challenges due to the complexity of accurately modeling the Android framework. In this paper, we investigate whether off-the-shelf Large Language Models (LLMs) can effectively reason about taint flows in Android apps. Our preliminary approach relies on an agentic interaction strategy, enabling the LLM to iteratively explore code and reason about data flows. We conduct an initial evaluation on the DroidBench benchmark against FlowDroid, where our approach outperforms the baseline: Gemini-3 Flash achieves an F1-score of 0.96, compared to 0.55 for FlowDroid. In particular, we observe improvements in challenging categories such as inter-component communication (0.95 vs. 0.17), implicit flows (0.94 vs. 0.00), and reflection (1.00 vs. 0.50), where FlowDroid typically struggles. On a small set of real-world apps, the LLM-based approach also identifies additional potential data leaks not reported by FlowDroid. These preliminary findings suggest that LLM reasoning may effectively complement traditional static taint analysis, motivating future research on hybrid LLM-enhanced taint analysis pipelines.
Android apps currently dominate the smartphone app market, and their reliability will significantly affect user experience and even induce security risks. Since Android Gradle Plugin 3.4.0 (April 2019), the R8 compiler serves as the default infrastructure in the Android build process. It transforms JVM bytecode from the Java layer into semantic-equivalent DEX bytecode, ensuring compatibility with the Android Virtual Machine. Additionally, R8 incorporates advanced features like shrinking and obfuscation to reduce app size and enhance security. However, R8 suffers from substantial bugs, some of which can cause severe issues. This motivates us to conduct a preliminary study into R8 bugs. We collect and analyze 945 bug reports for R8. Through detailed statistical analysis, we obtain several valuable findings. For example, we identify Optimization as the most error-prone component. To substantiate our findings, we develop an automated testing tool named R8Scan. It utilizes a novel idea to synthesize seeds from prioritized real-world functions and construct the corresponding arguments empowered by Large Language Models (LLMs) to test R8, thus enabling the exploration of a broader range of semantics. Finally, R8Scan detects 17 R8 bugs. It also detects 10 bugs in OpenJDK and 6 bugs in Android Runtime. Among the R8 bugs, 11 are assigned priority P1, the highest developer-assigned priority level. Extensive experiments demonstrate the superiority of R8Scan over state-of-the-art JVM fuzzers. We believe this study is valuable to enhance the security of the R8 compiler.
Zifan Xie, Ming Wen, Shiyu Qiu et al.· ACM Transactions on Software...· 0 citations
To reduce the substantial engineering effort required to test the corresponding applications from Android to OpenHarmony, migrating existing GUI test cases has become a critical problem. However, current research neither proposes solutions tailored for OpenHarmony nor provides a systematic evaluation of migration approaches on this system, leaving developers with limited empirical guidance in practice. In this paper, we present the first systematic empirical study of test migration from Android to OpenHarmony. Specifically, we first construct a dataset referred to as the ATH Benchmark, comprising 36 commercial applications with an average of over 9 billion downloads, along with 108 manually designed test cases. Second, we select two state-of-the-art test migration approaches (i.e., ReSPlay and ITeM) and adapt these two approaches to enable their execution on OpenHarmony. Third, we use the preceding infrastructure to evaluate these two approaches from three perspectives, including testing performance, root causes of failures, and the impact of OpenHarmony characteristics. Our results reveal that existing test migration approaches are less effective (15% success-rate on ReSPlay and 26% success-rate on ITeM) in Android-to-OpenHarmony scenarios. Through an in-depth analysis of failed cases, we identify that test performance is primarily hindered by OpenHarmony-specific characteristics, including technical architecture differences and unique ecosystem traits. Utilizing these findings, we propose an enhanced approach based on ITeM, referred as ITeM-HM, which incorporates specific OpenHarmony system features. As a result, ITeM-HM successfully achieves a 214% success-rate relative improvement over the original ITeM (from 26% to 81%).
Yakun Zhang, Xinjia Chen, Yiyun Chen et al.· 0 citations
Android app development traditionally relies on Java and native languages (C/C++), leading most existing Android analysis tools to focus on these languages. However, cross-platform languages are increasingly used in mobile development, with C# being a representative example. Our preliminary study shows that approximately 14% of real-world Android apps contain C# code, underscoring the need for systematic analysis. Unlike Java code, C# code in these apps runs in a separate managed runtime, while existing tools lack support for cross-runtime analysis of C# and Java code in Android apps. To bridge this gap, we introduce Shalton, a static analysis framework that analyzes CIL bytecode from C# and Dalvik bytecode from Java. Shalton represents CIL bytecode in a Dalvik-compatible form and reconstructs interactions between CIL and Dalvik components, enabling existing Android static analyzers to reason about both bytecode formats. We evaluate Shalton using a new benchmark, SharpDroidBench, and real-world Android apps. The results show that C# code participates in analysis-relevant behaviors, including dynamic code loading and sensitive data transmission. Shalton substantially outperforms a translation-based baseline on SharpDroidBench and enables existing Android analyzers to inspect CIL-implemented app logic that would otherwise remain outside their scope.
Runze Tan, Jun-Tao Hu, Lei Xue et al.· ACM Transactions on Software...· 0 citations
Cross-platform frameworks such as Flutter and React Native are increasingly adopted in Android application development, yet their security characteristics at scale remain insufficiently understood. In this paper, we present an empirical security characterization of 3,000 Android applications, consisting of 1,000 Flutter-based applications, 1,000 React Native apps, and 1,000 Kotlin-based native applications used as a baseline. Using MobSF and FlowDroid static analysis, we analyze security assessment scores as well as the prevalence of warning-level and high-severity findings across these development ecosystems. The results show consistent but modest differences in average scores and reported finding distributions, with cross-platform applications exhibiting distinct distributional patterns compared to native Kotlin applications. These observations do not imply framework-level vulnerabilities. Rather, they reflect ecosystemlevel tendencies associated with framework architectures, build configurations, and commonly used dependencies. This study characterizes Android security traits reported by static analysis tools and demonstrates that cross-platform and native applications should be interpreted with framework context in mind.
Devin Sterling, Yash Patel, Samantha Zuza et al.· Annual International Compute...· 0 citations