Systematic Analysis of Smartphone Architectural Security: A Multi-Layered Vulnerability Assessment of Android and iOS Ecosystems (2020-2025)
DOI:
https://doi.org/10.29284/78p5ps30Keywords:
Smartphone security architecture, Android and iOS vulnerabilities, Multi-layer vulnerability analysis, Operating system securityAbstract
Android and iOS constitute the major smartphone players on the world stage, but there is still limited knowledge on their architectural security flaws. This paper is a multi-layered vulnerability evaluation of the Android and iOS platform on the basis of vulnerabilities that are publicly disclosed between 2020 and 2025. A total of 5647 vulnerabilities were analyzed, of which 3192 are for Android and 2455 are for iOS. Vulnerabilities were assigned to a structured architectural security model that includes hardware and firmware, kernel and operating system core, system services and middleware, application framework, and ecosystem and update mechanisms. The results show that vulnerabilities are disproportionately distributed across the various layers of the architecture, with the kernel layer, system services, and application framework layers contributing to the greatest number of disclosures with the highest severity levels. More than half of all the reported issues are cross-layer vulnerabilities which illustrate the weakness of a rigid layer isolation. Platform-specific differences in vulnerability concentration and patch latency distributions as one of the comparative analysis indicators portray different architectural design and ecosystem governance models. This paper places vulnerabilities into their own architectural context to offer a longitudinal and comparative overview of systemic security risk, which can be applied to platform designers, researchers and security practitioners aiming to enhance smartphone architectures.References
1. Pagano, F., Romdhana, A., Caputo, D., Verderame, L., & Merlo, A. (2023). SEBASTiAn: A static and extensible black-box application security testing tool for iOS and Android applications. SoftwareX, 23, 101448.
2. Arikan, K. E., & Yilmaz, E. N. (2025). AndroCom: A Real-World Android Applications' Vulnerability Dataset to Assist with Automatically Detecting Vulnerabilities. Applied Sciences (2076-3417), 15(5).
3. Hatamian, M., Wairimu, S., Momen, N., & Fritsch, L. (2021). A privacy and security analysis of early-deployed COVID-19 contact tracing Android apps. Empirical software engineering, 26(3), 36.
4. Daoudi, N., Allix, K., Bissyandé, T. F., & Klein, J. (2023). Assessing the opportunity of combining state-of-the-art Android malware detectors. Empirical Software Engineering, 28(2), 22.
5. Daoudi, N., Allix, K., Bissyandé, T. F., & Klein, J. (2021). Lessons learnt on reproducibility in machine learning based android malware detection. Empirical Software Engineering, 26(4), 74.
6. Kargén, U., Mauthe, N., & Shahmehri, N. (2023). Android decompiler performance on benign and malicious apps: an empirical study. Empirical Software Engineering, 28(2), 48.
7. Senanayake, J., Kalutarage, H., & Al-Kadri, M. O. (2021). Android mobile malware detection using machine learning: A systematic review. Electronics, 10(13), 1606.
8. Alkahtani, H., & Aldhyani, T. H. (2022). Artificial intelligence algorithms for malware detection in android-operated mobile devices. Sensors, 22(6), 2268.
9. Gómez, A., & Munoz, A. (2023). Deep learning-based attack detection and classification in Android devices. Electronics, 12(15), 3253.
10. Kacem, T., & Tossou, S. (2025). Trandroid: An Android Mobile Threat Detection System Using Transformer Neural Networks. Electronics, 14(6), 1230.
11. Zhao, Y., Sun, S., Huang, X., & Zhang, J. (2025). An android malware detection method using frequent graph convolutional neural networks. Electronics, 14(6), 1151.
12. Allen, A., Mylonas, A., Vidalis, S., & Gritzalis, D. (2024). Security Evaluation of Companion Android Applications in IoT: The Case of Smart Security Devices. Sensors, 24(17), 5465.
13. Surma, Z. A., Gowdar, S., & Pandit, H. J. (2024). Examining the Integrity of Apple’s Privacy Labels: GDPR Compliance and Unnecessary Data Collection in iOS Apps. Information, 15(9), 551.
14. Kouliaridis, V., & Kambourakis, G. (2021). A comprehensive survey on machine learning techniques for android malware detection. Information, 12(5), 185.
15. Zukarnain, Z. A., Muneer, A., & Ab Aziz, M. K. (2022). Authentication securing methods for mobile identity: Issues, solutions and challenges. Symmetry, 14(4), 821.
16. National Institute of Standards and Technology. (n.d.). NVD – API Key Request. National Vulnerability Database. Retrieved January 20, 2026, from https://nvd.nist.gov/developers/request-an-api-key/
17. Oh, I., Sahlabadi, M., Yim, K., & Lee, S. (2025). Threat Classification and Vulnerability Analysis on 5G Firmware Over-the-Air Updates for Mobile and Automotive Platforms. Electronics, 14(10), 2034.
18. Anglano, C. (2025). A Review of Mobile Surveillanceware: Capabilities, Countermeasures, and Research Challenges. Electronics, 14(14), 2763.
19. Alamri, H., Maple, C., Mohamad, S., & Epiphaniou, G. (2022). Do the right thing: A privacy policy adherence analysis of over two million apps in apple ios app store. Sensors, 22(22), 8964.
20. Sanna, S. L., Soi, D., Maiorca, D., Fumera, G., & Giacinto, G. (2024). A risk estimation study of native code vulnerabilities in Android applications. Journal of Cybersecurity, 10(1), tyae015.
21. Muñoz, A. (2024). Cracking the core: Hardware vulnerabilities in android devices unveiled. Electronics, 13(21), 4269.
22. Bhurtel, M., & Rawat, D. B. (2023). Unveiling the Landscape of Operating System Vulnerabilities. Future Internet, 15(7), 248.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution 4.0 International License.
This work is licensed under a Creative Commons Attribution 4.0 International License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
