Collected research

Uncovering and Exploiting Hidden APIs in Mobile Super Apps

[2306.08134] Uncovering and Exploiting Hidden APIs in Mobile Super Apps

Chao Wang, Yue Zhang and Zhiqiang Lin · arXiv.org

Mobile super apps such as WeChat, WeCom, Baidu, QQ and TikTok expose undocumented bridge APIs to the miniapps that run inside them, and many carry no permission check. A static-plus-dynamic tool, APIScope, recovers these hidden APIs and confirms an unprivileged third-party miniapp can call them to reach Android-permission-protected resources, open arbitrary web pages, install software and steal sensitive data.

Record

Document

[2306.08134] Uncovering and Exploiting Hidden APIs in Mobile Super Apps

Researcher

Chao Wang, Yue Zhang and Zhiqiang Lin

Published by

arXiv.org

Topic

Other

In the archive

• Collected in the 2023 research round

Tags

• sandbox-escape
• privilege-escalation
• auth-bypass
• info-leak
• android
• javascript
• static-analysis
• dynamic-analysis
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Chao Wang, Yue Zhang and Zhiqiang Lin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.