#3960·mastg

[MASWE-0040] Add Dynamic test and demo for Android

Author: IPMegladonCreated Sep 11, 2026Updated Sep 11, 2026

For MASWE-0040 - Sensitive Data Leaked via Accessibility Services, the Test title: Runtime Check Of Sensitive Fields Not Using Secure Input

Summary: Test: Uiautomator can be used to query the android accessibility interface: adb exec-out uiautomator dump /dev/tty Sensitive fields should return as text="••••••" password="true".

Note: it is important that the app does not display the entered data before masking it as this can still be captured, e.g. this will look like text="••3", text="•••4" from an Accessibility perspective. Of course this will not prevent against touchjacking (getting coords of where user taps) or overlay attacks, both of which I believe can be done with accessibility options.