https://actuator.sh/blog.html Original Android, mobile OAuth, WebView, and IoT security research from Actuator Security, including vulnerability analysis, tooling, and exploit methodology. en-us Thu, 01 Oct 2026 22:13:00 +0000 https://actuator.sh/blog/2026-08-the-wrong-dropdown.html https://actuator.sh/blog/2026-08-the-wrong-dropdown.html Fri, 05 Jun 2026 12:00:00 +0000 Existing mobile OAuth research assumes the target is a public client. A subset of Android apps registered as Web clients on Google Cloud Console ship a client_secret in their APK. This is the unpublished half of the chain, demonstrated end-to-end on ColorNote (100M+ installs). https://actuator.sh/blog/2026-01-dialer-risk.html https://actuator.sh/blog/2026-01-dialer-risk.html Thu, 22 Jan 2026 12:00:00 +0000 An examination of systemic security failures in third-party Android dialers, focusing on exported components, intent abuse, and real-world vulnerabilities enabling elevation of phone permissions. https://actuator.sh/blog/2026-01-jsi.html https://actuator.sh/blog/2026-01-jsi.html Mon, 19 Jan 2026 12:00:00 +0000 An overview of common patterns leading to unintended JavaScript interface exposure in Android WebView implementations and their implications during security assessment.