Security and Privacy Assessment of U.S. and Non-U.S. Android E-Commerce Applications

2025/10/14 by Kishnani, Urvashi, Das, Sanchari
#Cryptography and Security (cs.CR) #FOS: Computer and information sciences

paper · doi:10.48550/arxiv.2510.12031

Abstract

E-commerce mobile applications are central to global financial transactions, making their security and privacy crucial. In this study, we analyze 92 top-grossing Android e-commerce apps (58 U.S.-based and 34 international) using MobSF, AndroBugs, and RiskInDroid. Our analysis shows widespread SSL and certificate weaknesses, with approximately 92% using unsecured HTTP connections and an average MobSF security score of 40.92/100. Over-privileged permissions were identified in 77 apps. While U.S. apps exhibited fewer manifest, code, and certificate vulnerabilities, both groups showed similar network-related issues. We advocate for the adoption of stronger, standardized, and user-focused security practices across regions.

Related

• Security Apps under the Looking Glass: An Empirical Analysis of Android Security Apps
• Danger is My Middle Name: Experimenting with SSL Vulnerabilities in Android Apps
• Mobile App Security Trends and Topics: An Examination of Questions From Stack Overflow
• An Empirical Assessment of Security Risks of Global Android Banking Apps
• Should Users Trust Their Android Devices? A Scoring System for Assessing Security and Privacy Risks of Pre-Installed Applications