More than three years after our initial reports, we revisited the iOS data flow restriction bypasses on iOS 27.0.1. While Apple has closed at least one of the previously demonstrated paths, the fundamental problem remains: data can still cross the managed/unmanaged boundary using built-in iOS functionality. In 2023, we reported several ways to circumvent Apple’s … read more

Objective-C has been the foundational language of the iOS ecosystem, serving as the primary language for building applications on Apple’s mobile platform. But times have changed. In our study [1] of 84,000 unique iOS apps collected over five years (2020-2025), we found that today’s App Store hosts a rich variety of programming languages. Modern iOS … read more

Android 11 introduced a protection for the installed apps list through a permission, treating it as sensitive personal data. In theory, any app wanting that information must request a special, tightly controlled permission. In practice, this post shows that a simple manifest trick allows apps to bypass those protections entirely and list almost all installed … read more