The OWApp Benchmark: An OWASP-Compliant Vulnerable Android App Dataset

Static Application Security Testing (SAST) tools play a critical role in detecting vulnerabilities in mobile apps by analyzing the source code without executing the app. These tools are essential in modern development workflows, particularly in Continuous Integration/Continuous Deployment (CI/CD) pipelines. However, SAST tools face significant limitations due to their dependence on predefined rules and patterns. As a result, many vulnerabilities, particularly complex ones, such as cryptographic flaws or multi-component interactions, go undetected. Despite the introduction of unified frameworks such as the OWASP Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MASTG), which standardize mobile application security assessments, the data sets used to train and evaluate SAST tools of Android Apps cover only specific categories of vulnerabilities. In addition, most of the available datasets do not contain recent vulnerability patterns. To fill this gap, this paper introduces a novel and comprehensive vulnerable app dataset for Android Apps (i.e., the OWApp Benchmark) that maps the OWASP MASVS. This benchmark improves the evaluation of Android SAST tools by providing broader coverage of security controls, thus enhancing the detection of a more comprehensive range of vulnerabilities. Each dataset entry includes source code, APK, vulnerability details, and relevant artifacts to support accurate evaluations.