{"id":"https://openalex.org/W7163083392","doi":"https://doi.org/10.1007/s42979-026-05054-w","title":"Opportunistic Permission Exploitation of Third-Party Libraries in Android Apps","display_name":"Opportunistic Permission Exploitation of Third-Party Libraries in Android Apps","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7163083392","doi":"https://doi.org/10.1007/s42979-026-05054-w"},"language":"en","primary_location":{"id":"doi:10.1007/s42979-026-05054-w","doi":"https://doi.org/10.1007/s42979-026-05054-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s42979-026-05054-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s42979-026-05054-w.pdf","source":{"id":"https://openalex.org/S4210174798","display_name":"SN Computer Science","issn_l":"2661-8907","issn":["2661-8907","2662-995X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-4","vabb-shw"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"SN Computer Science","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s42979-026-05054-w.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5023681451","display_name":"Kris Heid","orcid":"https://orcid.org/0000-0001-7739-224X","observed_orcids":["https://orcid.org/0000-0001-7739-224X"]},"institutions":[{"id":"https://openalex.org/I4210133470","display_name":"Fraunhofer Institute for Secure Information Technology","ror":"https://ror.org/03qt2gs44","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210133470","https://openalex.org/I4923324"]},{"id":"https://openalex.org/I4210135606","display_name":"National Research Center for Applied Cybersecurity ATHENE","ror":"https://ror.org/0378v2g76","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210135606"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Kris Heid","raw_affiliation_strings":["Testlab Mobile Security, Fraunhofer SIT\u2013ATHENE-National Research Center for Applied Cybersecurity, Rheinstra\u00dfe 75, 64295, Darmstadt, Hessen, Germany"],"raw_orcid":"https://orcid.org/0000-0001-7739-224X","affiliations":[{"raw_affiliation_string":"Testlab Mobile Security, Fraunhofer SIT\u2013ATHENE-National Research Center for Applied Cybersecurity, Rheinstra\u00dfe 75, 64295, Darmstadt, Hessen, Germany","institution_ids":["https://openalex.org/I4210133470","https://openalex.org/I4210135606"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137563536","display_name":"Elena Julia Sonntag","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210133470","display_name":"Fraunhofer Institute for Secure Information Technology","ror":"https://ror.org/03qt2gs44","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210133470","https://openalex.org/I4923324"]},{"id":"https://openalex.org/I4210135606","display_name":"National Research Center for Applied Cybersecurity ATHENE","ror":"https://ror.org/0378v2g76","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210135606"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Elena Julia Sonntag","raw_affiliation_strings":["Testlab Mobile Security, Fraunhofer SIT\u2013ATHENE-National Research Center for Applied Cybersecurity, Rheinstra\u00dfe 75, 64295, Darmstadt, Hessen, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Testlab Mobile Security, Fraunhofer SIT\u2013ATHENE-National Research Center for Applied Cybersecurity, Rheinstra\u00dfe 75, 64295, Darmstadt, Hessen, Germany","institution_ids":["https://openalex.org/I4210133470","https://openalex.org/I4210135606"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5001100921","display_name":"Jens Heider","orcid":"https://orcid.org/0000-0001-8343-6608","observed_orcids":["https://orcid.org/0000-0001-8343-6608"]},"institutions":[{"id":"https://openalex.org/I4210133470","display_name":"Fraunhofer Institute for Secure Information Technology","ror":"https://ror.org/03qt2gs44","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210133470","https://openalex.org/I4923324"]},{"id":"https://openalex.org/I4210135606","display_name":"National Research Center for Applied Cybersecurity ATHENE","ror":"https://ror.org/0378v2g76","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210135606"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Jens Heider","raw_affiliation_strings":["Testlab Mobile Security, Fraunhofer SIT\u2013ATHENE-National Research Center for Applied Cybersecurity, Rheinstra\u00dfe 75, 64295, Darmstadt, Hessen, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Testlab Mobile Security, Fraunhofer SIT\u2013ATHENE-National Research Center for Applied Cybersecurity, Rheinstra\u00dfe 75, 64295, Darmstadt, Hessen, Germany","institution_ids":["https://openalex.org/I4210133470","https://openalex.org/I4210135606"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5023681451"],"corresponding_institution_ids":["https://openalex.org/I4210133470","https://openalex.org/I4210135606"],"apc_list":{"value":3190,"currency":"USD","value_usd":3190},"apc_paid":{"value":3190,"currency":"USD","value_usd":3190},"fwci":3.62,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.89753421,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":"7","issue":"5","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9276999831199646,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9276999831199646,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.03500000014901161,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.011500000022351742,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/third-party-libraries","display_name":"third-party libraries","score":0.8550000190734863},{"id":"https://openalex.org/keywords/android-permissions","display_name":"Android permissions","score":0.7760000228881836},{"id":"https://openalex.org/keywords/mobile-app-privacy","display_name":"mobile app privacy","score":0.5709999799728394},{"id":"https://openalex.org/keywords/data-collection","display_name":"data collection","score":0.503000020980835},{"id":"https://openalex.org/keywords/permission-inheritance","display_name":"permission inheritance","score":0.625},{"id":"https://openalex.org/keywords/android-app-store","display_name":"Android app store","score":0.5590000152587891}],"concepts":[{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.9472000002861023},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8399999737739563},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.7821999788284302},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6843000054359436},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.5338000059127808},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.49729999899864197},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.4499000012874603},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4242999851703644},{"id":"https://openalex.org/C47487241","wikidata":"https://www.wikidata.org/wiki/Q5227230","display_name":"Data access","level":2,"score":0.32330000400543213},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.31470000743865967},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.3068000078201294},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.30239999294281006},{"id":"https://openalex.org/C3017597292","wikidata":"https://www.wikidata.org/wiki/Q25052250","display_name":"Privacy protection","level":2,"score":0.26330000162124634},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.2619999945163727},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2540999948978424}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s42979-026-05054-w","doi":"https://doi.org/10.1007/s42979-026-05054-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s42979-026-05054-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s42979-026-05054-w.pdf","source":{"id":"https://openalex.org/S4210174798","display_name":"SN Computer Science","issn_l":"2661-8907","issn":["2661-8907","2662-995X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-4","vabb-shw"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"SN Computer Science","raw_type":"journal-article"},{"id":"pmh:oai:publica.fraunhofer.de:publica/518755","doi":null,"is_oa":true,"landing_page_url":"https://publica.fraunhofer.de/handle/publica/518755","pdf_url":null,"source":{"id":"https://openalex.org/S4306400318","display_name":"Fraunhofer-Publica (Fraunhofer-Gesellschaft)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4923324","host_organization_name":"Fraunhofer-Gesellschaft","host_organization_lineage":["https://openalex.org/I4923324"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"journal article"}],"best_oa_location":{"id":"doi:10.1007/s42979-026-05054-w","doi":"https://doi.org/10.1007/s42979-026-05054-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s42979-026-05054-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s42979-026-05054-w.pdf","source":{"id":"https://openalex.org/S4210174798","display_name":"SN Computer Science","issn_l":"2661-8907","issn":["2661-8907","2662-995X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-4","vabb-shw"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"SN Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320318200","display_name":"Fraunhofer-Institut f\u00fcr Sichere Informationstechnologie","ror":"https://ror.org/03qt2gs44"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7163083392.pdf","grobid_xml":"https://content.openalex.org/works/W7163083392.grobid-xml"},"referenced_works_count":18,"referenced_works":["https://openalex.org/W1499707862","https://openalex.org/W1972350641","https://openalex.org/W2049917012","https://openalex.org/W2060727319","https://openalex.org/W2065847453","https://openalex.org/W2071672346","https://openalex.org/W2087804676","https://openalex.org/W2114275288","https://openalex.org/W2123437505","https://openalex.org/W2140095007","https://openalex.org/W2519687663","https://openalex.org/W2573983983","https://openalex.org/W2784134919","https://openalex.org/W2797171593","https://openalex.org/W3200506265","https://openalex.org/W4384304731","https://openalex.org/W4399332531","https://openalex.org/W4407938030"],"related_works":["https://openalex.org/W4407938030","https://openalex.org/W2807044067","https://openalex.org/W2618907494","https://openalex.org/W4324118777","https://openalex.org/W2532717356","https://openalex.org/W2904440763","https://openalex.org/W4379013895","https://openalex.org/W3215981623","https://openalex.org/W2923317037","https://openalex.org/W2304088763"],"abstract_inverted_index":{"Abstract":[0],"The":[1],"Android":[2,38,137,195],"app":[3],"store":[4],"hosts":[5],"millions":[6],"of":[7,14,25,175],"applications":[8],"developed":[9,42],"by":[10,154],"a":[11,146],"vast":[12],"number":[13],"developers,":[15],"making":[16],"it":[17,65],"challenging":[18],"for":[19,117],"users":[20,45],"to":[21,43,51,91,139,150,179,189,196],"assess":[22],"the":[23,37,60,72,76,136],"trustworthiness":[24],"individual":[26],"apps":[27],"and":[28,34,54,85,95,111,157,200],"their":[29],"creators.":[30],"To":[31],"address":[32],"privacy":[33,127,199],"security":[35],"concerns,":[36],"permission":[39,83,86,152,168],"system":[40,55],"was":[41],"grant":[44],"control":[46],"over":[47],"each":[48],"app\u2019s":[49],"access":[50,96],"sensitive":[52],"data":[53,98,119],"components.":[56],"However,":[57],"even":[58],"if":[59],"core":[61],"application":[62],"is":[63,170],"trustworthy,":[64],"often":[66],"incorporates":[67],"third-party":[68,155,176],"libraries":[69,90,156,177],"that":[70,167],"inherit":[71],"same":[73],"permissions":[74,94,102],"as":[75,81],"host":[77],"app.":[78],"Techniques":[79],"such":[80],"opportunistic":[82],"usage":[84],"piggybacking":[87,153,169],"allow":[88],"these":[89],"exploit":[92,180],"available":[93],"user":[97,198],"without":[99],"explicitly":[100],"requesting":[101],"themselves.":[103],"These":[104,183],"practices":[105],"are":[106,115],"particularly":[107],"prevalent":[108],"among":[109],"advertising":[110],"tracking":[112],"libraries,":[113],"which":[114],"notorious":[116],"extensive":[118],"collection.":[120],"Although":[121],"several":[122],"studies":[123],"have":[124],"identified":[125],"this":[126,142,181],"gap,":[128],"no":[129],"effective":[130],"solution":[131],"has":[132],"been":[133],"integrated":[134],"into":[135],"ecosystem":[138],"date.":[140],"In":[141],"work,":[143],"we":[144],"present":[145],"novel":[147],"analysis":[148],"methodology":[149],"detect":[151],"evaluate":[158],"its":[159],"impact":[160],"on":[161],"real-world":[162],"applications.":[163],"Our":[164],"results":[165],"reveal":[166],"highly":[171],"prevalent,":[172],"with":[173],"50%":[174],"attempting":[178],"loophole.":[182],"findings":[184],"highlight":[185],"an":[186],"urgent":[187],"need":[188],"implement":[190],"existing":[191],"mitigation":[192],"strategies":[193],"within":[194],"enhance":[197],"security.":[201]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-06-02T00:00:00"}