OWASP · cpholguera · Aug 3, 2026 · Jul 19, 2026 · Jul 19, 2026 · Aug 2, 2026
diff --git a/best-practices/MASTG-BEST-0007.md b/best-practices/MASTG-BEST-0007.md
@@ -8,4 +8,4 @@ knowledge: [MASTG-KNOW-0007]
 
 Ensure the debuggable flag in the AndroidManifest.xml is set to `false` for all release builds.
 
-**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0101 for detailed guidance.
+**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0064 for detailed guidance.
diff --git a/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md b/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md
@@ -6,7 +6,7 @@ title: Certificate Pinning
 
 [Certificate pinning](../../../Document/0x04f-Testing-Network-Communication.md#restricting-trust-identity-pinning) can be employed in Android apps to safeguard against Machine-in-the-Middle (MITM) attacks by ensuring that the app communicates exclusively with remote endpoints possessing specific identities.
 
-While effective when implemented correctly, insecure implementations potentially enable attackers to read and modify all communication. For more general details on pinning, refer to @MASWE-0047.
+While effective when implemented correctly, insecure implementations potentially enable attackers to read and modify all communication. For more general details on pinning, refer to @MASWE-0028.
 
 Several approaches to certificate pinning exist, depending on the app's API level and the libraries used. Below, we highlight the most common methods. For a deeper dive into the specific implementations, see ["Deep Dive into Certificate Pinning on Android"](https://securevale.blog/articles/deep-dive-into-certificate-pinning-on-android/).
 

diff --git a/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md b/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md
@@ -27,7 +27,7 @@ References:
 
 [Certificate pinning](../../../Document/0x04f-Testing-Network-Communication.md#restricting-trust-identity-pinning) allows an iOS app to reject certificates that don't match a specific expected identity, guarding against Machine-in-the-Middle (MITM) attacks even when an attacker controls a CA that is trusted by the system.
 
-Because pinning is layered on top of standard HTTPS, it does not weaken the underlying TLS connection. The risk lies in misconfiguration rather than in the mechanism itself. If pins are not maintained correctly, for example pinning a public key without providing a backup pin, or failing to update the pinned values before the server's certificate or key is rotated, the app will reject otherwise valid connections and break communication with the affected endpoints. This makes pinning misconfiguration an availability risk for the APIs the app depends on. For more general details on pinning, refer to @MASWE-0047.
+Because pinning is layered on top of standard HTTPS, it does not weaken the underlying TLS connection. The risk lies in misconfiguration rather than in the mechanism itself. If pins are not maintained correctly, for example pinning a public key without providing a backup pin, or failing to update the pinned values before the server's certificate or key is rotated, the app will reject otherwise valid connections and break communication with the affected endpoints. This makes pinning misconfiguration an availability risk for the APIs the app depends on. For more general details on pinning, refer to @MASWE-0028.
 
 **Important Considerations:**
 

diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md
@@ -4,7 +4,7 @@ title: References to APIs Allowing Fallback to Non-Biometric Authentication
 id: MASTG-TEST-0326
 apis: [BiometricPrompt, BiometricManager.Authenticators, setAllowedAuthenticators]
 type: [static, code]
-weakness: MASWE-0045
+weakness: MASWE-0021
 profiles: [L2]
 knowledge: [MASTG-KNOW-0001]
 best-practices: [MASTG-BEST-0031]

diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md
@@ -4,7 +4,7 @@ title: References to APIs for Event-Bound Biometric Authentication
 id: MASTG-TEST-0327
 apis: [BiometricPrompt, BiometricPrompt.CryptoObject, authenticate]
 type: [static, code]
-weakness: MASWE-0044
+weakness: MASWE-0020
 profiles: [L2]
 knowledge: [MASTG-KNOW-0001, MASTG-KNOW-0043, MASTG-KNOW-0047, MASTG-KNOW-0012]
 best-practices: [MASTG-BEST-0036]

diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md
@@ -4,7 +4,7 @@ title: References to APIs Detecting Biometric Enrollment Changes
 id: MASTG-TEST-0328
 apis: [KeyGenParameterSpec.Builder, setInvalidatedByBiometricEnrollment]
 type: [static, code]
-weakness: MASWE-0046
+weakness: MASWE-0022
 profiles: [L2]
 knowledge: [MASTG-KNOW-0001]
 best-practices: [MASTG-BEST-0037]

diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md
@@ -4,7 +4,7 @@ title: References to APIs Enforcing Authentication without Explicit User Action
 id: MASTG-TEST-0329
 apis: [BiometricPrompt.PromptInfo.Builder, setConfirmationRequired]
 type: [static, code]
-weakness: MASWE-0044
+weakness: MASWE-0020
 profiles: [L2]
 knowledge: [MASTG-KNOW-0001]
 best-practices: [MASTG-BEST-0038]

diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md
@@ -4,7 +4,7 @@ title: References to APIs for Keys used in Biometric Authentication with Extende
 id: MASTG-TEST-0330
 apis: [KeyGenParameterSpec.Builder, setUserAuthenticationParameters, setUserAuthenticationValidityDurationSeconds]
 type: [static, code]
-weakness: MASWE-0044
+weakness: MASWE-0020
 profiles: [L2]
 knowledge: [MASTG-KNOW-0001, MASTG-KNOW-0043, MASTG-KNOW-0047, MASTG-KNOW-0012]
 best-practices: [MASTG-BEST-0036]

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md
@@ -4,7 +4,7 @@ platform: android
 id: MASTG-TEST-0222
 deprecated_since: 21
 type: [static, code]
-weakness: MASWE-0116
+weakness: MASWE-0045
 profiles: [L2]
 knowledge: [MASTG-KNOW-0006]
 ---

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md
@@ -3,7 +3,7 @@ title: Stack Canaries Not Enabled
 platform: android
 id: MASTG-TEST-0223
 type: [static, code]
-weakness: MASWE-0116
+weakness: MASWE-0045
 profiles: [L2]
 knowledge: [MASTG-KNOW-0006]
 ---

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md
@@ -4,7 +4,7 @@ title: References to Platform Version APIs
 id: MASTG-TEST-0245
 apis: [Build]
 type: [static, code]
-weakness: MASWE-0077
+weakness: MASWE-0041
 best-practices: []
 profiles: [L2]
 ---

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md
@@ -3,7 +3,7 @@ platform: android
 title: Identify Dependencies with Known Vulnerabilities in the Android Project
 id: MASTG-TEST-0272
 type: [static, code]
-weakness: MASWE-0076
+weakness: MASWE-0044
 profiles: [L1, L2]
 ---
 

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md
@@ -3,7 +3,7 @@ platform: android
 title: Dependencies with Known Vulnerabilities in the App's SBOM
 id: MASTG-TEST-0274
 type: [static, developer]
-weakness: MASWE-0076
+weakness: MASWE-0044
 profiles: [L1, L2]
 ---
 

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md
@@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data
 platform: android
 id: MASTG-TEST-0337
 type: [static, code]
-weakness: MASWE-0088
+weakness: MASWE-0050
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0021]
 ---

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md
@@ -3,7 +3,7 @@ title: SQL Injection in Content Providers
 platform: android
 id: MASTG-TEST-0339
 type: [static, code]
-weakness: MASWE-0086
+weakness: MASWE-0050
 best-practices: [MASTG-BEST-0039]
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0117]

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md
@@ -3,7 +3,7 @@ title: Implicit Intents Used for Internal App Communication
 platform: android
 id: MASTG-TEST-0372
 type: [static, code, manual]
-weakness: MASWE-0066
+weakness: MASWE-0032
 best-practices: [MASTG-BEST-0056]
 knowledge: [MASTG-KNOW-0025]
 profiles: [L1, L2]

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md
@@ -3,7 +3,7 @@ title: References to Implicit Intents Carrying Sensitive Extras
 platform: android
 id: MASTG-TEST-0374
 type: [static, code, manual]
-weakness: MASWE-0066
+weakness: MASWE-0032
 best-practices: [MASTG-BEST-0056]
 knowledge: [MASTG-KNOW-0025]
 profiles: [L1, L2]

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md
@@ -3,7 +3,7 @@ title: Missing Validation of Data Returned from Implicit Intents
 platform: android
 id: MASTG-TEST-0375
 type: [dynamic, hooks, manual]
-weakness: MASWE-0083
+weakness: MASWE-0050
 best-practices: [MASTG-BEST-0057]
 knowledge: [MASTG-KNOW-0025, MASTG-KNOW-0138]
 profiles: [L1, L2]

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md
@@ -3,7 +3,7 @@ platform: android
 title: Runtime Use of Enforced Updating APIs
 id: MASTG-TEST-0382
 type: [dynamic, network, hooks, manual]
-weakness: MASWE-0075
+weakness: MASWE-0043
 profiles: [L2]
 knowledge: [MASTG-KNOW-0023]
 ---

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md
@@ -3,7 +3,7 @@ platform: android
 title: References to Enforced Updating APIs
 id: MASTG-TEST-0392
 type: [static, code, manual]
-weakness: MASWE-0075
+weakness: MASWE-0043
 profiles: [L2]
 knowledge: [MASTG-KNOW-0023]
 ---

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md
@@ -4,7 +4,7 @@ title: References to WebViewClient URL Loading Handlers
 id: MASTG-TEST-0398
 apis: [WebView, WebViewClient, shouldOverrideUrlLoading, shouldInterceptRequest, setWebViewClient]
 type: [static, code, manual]
-weakness: MASWE-0071
+weakness: MASWE-0035
 best-practices: []
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0018]

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md
@@ -4,7 +4,7 @@ title: SafeBrowsing Disabled
 id: MASTG-TEST-0399
 apis: [WebView, WebSettings, EnableSafeBrowsing, setSafeBrowsingEnabled]
 type: [static, config, code]
-weakness: MASWE-0071
+weakness: MASWE-0035
 best-practices: []
 knowledge: [MASTG-KNOW-0018]
 available_since: 27

diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md
@@ -4,7 +4,7 @@ title: Runtime Use of WebViewClient URL Loading Handlers
 id: MASTG-TEST-0400
 apis: [WebView, WebViewClient, shouldOverrideUrlLoading, shouldInterceptRequest, Uri, getHost, getScheme, getPath]
 type: [dynamic, hooks, manual]
-weakness: MASWE-0071
+weakness: MASWE-0035
 best-practices: []
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0018]

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md
@@ -7,7 +7,7 @@ best-practices: [MASTG-BEST-0001]
 prerequisites:
 - identify-sensitive-data
 - identify-security-relevant-contexts
-weakness: MASWE-0027
+weakness: MASWE-0012
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0013]
 ---

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md
@@ -7,7 +7,7 @@ best-practices: [MASTG-BEST-0001]
 prerequisites:
 - identify-sensitive-data
 - identify-security-relevant-contexts
-weakness: MASWE-0027
+weakness: MASWE-0012
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0013]
 ---

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md
@@ -3,7 +3,7 @@ platform: android
 title: Insufficient Key Sizes 
 id: MASTG-TEST-0208
 type: [static, code]
-weakness: MASWE-0009
+weakness: MASWE-0013
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0012]
 ---

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md
@@ -3,7 +3,7 @@ title: Use of Hardcoded Cryptographic Keys in Code
 platform: android
 id: MASTG-TEST-0212
 type: [static, code]
-weakness: MASWE-0014
+weakness: MASWE-0003
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0012]
 ---

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md
@@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Algorithms
 platform: android
 id: MASTG-TEST-0221
 type: [static, code, manual]
-weakness: MASWE-0020
+weakness: MASWE-0007
 best-practices: [MASTG-BEST-0009]
 profiles: [L1, L2]
 ---

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md
@@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Modes
 platform: android
 id: MASTG-TEST-0232
 type: [static, code, manual]
-weakness: MASWE-0020
+weakness: MASWE-0007
 best-practices: [MASTG-BEST-0005]
 profiles: [L1, L2]
 ---

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md
@@ -3,7 +3,7 @@ platform: android
 title: References to Asymmetric Key Pairs Used For Multiple Purposes
 id: MASTG-TEST-0307
 type: [static, code]
-weakness: MASWE-0012
+weakness: MASWE-0007
 profiles: [L2]
 knowledge: [MASTG-KNOW-0012]
 ---

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md
@@ -3,7 +3,7 @@ platform: android
 title: Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes
 id: MASTG-TEST-0308
 type: [dynamic, hooks]
-weakness: MASWE-0012
+weakness: MASWE-0007
 profiles: [L2]
 knowledge: [MASTG-KNOW-0012]
 ---

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md
@@ -3,7 +3,7 @@ platform: android
 title: References to Reused Initialization Vectors in Symmetric Encryption
 id: MASTG-TEST-0309
 type: [static, code]
-weakness: MASWE-0022
+weakness: MASWE-0007
 status: placeholder
 profiles: [L2]
 note: Reusing a symmetric key is acceptable when IVs or nonces follow the rules defined for the mode. NIST SP 800 38A states that CBC requires a fresh or unpredictable IV for every encryption. NIST SP 800 38D states that counter based modes require a nonce that never repeats under the same key. Repeating a key and IV or nonce pair defeats confidentiality and can also undermine integrity.

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md
@@ -3,7 +3,7 @@ platform: android
 title: Runtime Use of Reused Initialization Vectors in Symmetric Encryption
 id: MASTG-TEST-0310
 type: [dynamic, hooks]
-weakness: MASWE-0022
+weakness: MASWE-0007
 status: placeholder
 profiles: [L2]
 note: Reusing a symmetric key is acceptable when IVs or nonces follow the rules defined for the mode. NIST SP 800 38A states that CBC requires a fresh or unpredictable IV for every encryption. NIST SP 800 38D states that counter based modes require a nonce that never repeats under the same key. Repeating a key and IV or nonce pair defeats confidentiality and can also undermine integrity.

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md
@@ -3,7 +3,7 @@ title: References to Explicit Security Provider in Cryptographic APIs
 platform: android
 id: MASTG-TEST-0312
 type: [static, code]
-weakness: MASWE-0020
+weakness: MASWE-0007
 best-practices: [MASTG-BEST-0020]
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0011]

diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md
@@ -3,7 +3,7 @@ title: Runtime Use of Broken Symmetric Encryption Modes
 platform: android
 id: MASTG-TEST-0350
 type: [dynamic, hooks, manual]
-weakness: MASWE-0020
+weakness: MASWE-0007
 best-practices: [MASTG-BEST-0005]
 profiles: [L1, L2]
 ---

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md
@@ -3,7 +3,7 @@ title: Insecure TLS Protocols Explicitly Allowed in Code
 platform: android
 id: MASTG-TEST-0217
 type: [static, code]
-weakness: MASWE-0050
+weakness: MASWE-0026
 profiles: [L1, L2]
 ---
 

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md
@@ -3,7 +3,7 @@ title: Insecure TLS Protocols in Network Traffic
 platform: android
 id: MASTG-TEST-0218
 type: [dynamic, network]
-weakness: MASWE-0050
+weakness: MASWE-0026
 profiles: [L1, L2]
 ---
 

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md
@@ -3,7 +3,7 @@ title: Hardcoded HTTP URLs
 platform: android
 id: MASTG-TEST-0233
 type: [static, code]
-weakness: MASWE-0050
+weakness: MASWE-0026
 related-tests: [MASTG-TEST-0235, MASTG-TEST-0236, MASTG-TEST-0238]
 profiles: [L1, L2]
 ---

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md
@@ -3,7 +3,7 @@ title: Missing Implementation of Server Hostname Verification with SSLSockets
 platform: android
 id: MASTG-TEST-0234
 type: [static, code]
-weakness: MASWE-0052
+weakness: MASWE-0027
 profiles: [L1, L2]
 ---
 

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md
@@ -3,7 +3,7 @@ title: Android App Configurations Allowing Cleartext Traffic
 platform: android
 id: MASTG-TEST-0235
 type: [static, code]
-weakness: MASWE-0050
+weakness: MASWE-0026
 profiles: [L1, L2]
 knowledge: [MASTG-KNOW-0014]
 ---

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md
@@ -3,7 +3,7 @@ title: Cleartext Traffic Observed on the Network
 platform: network
 id: MASTG-TEST-0236
 type: [dynamic, network]
-weakness: MASWE-0050
+weakness: MASWE-0026
 profiles: [L1, L2]
 ---
 

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md
@@ -3,7 +3,7 @@ title: Cross-Platform Framework Configurations Allowing Cleartext Traffic
 platform: android
 id: MASTG-TEST-0237
 type: [static, code]
-weakness: MASWE-0050
+weakness: MASWE-0026
 status: placeholder
 note: Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed.
 profiles: [L1, L2]

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md
@@ -3,7 +3,7 @@ title: Runtime Use of Network APIs Transmitting Cleartext Traffic
 platform: android
 id: MASTG-TEST-0238
 type: [dynamic, hooks]
-weakness: MASWE-0050
+weakness: MASWE-0026
 status: placeholder
 note: Using Frida, you can trace all traffic of the app, mitigating the limitation of the dynamic analysis that you do not know which app, or which location is responsible for the traffic. Using Frida (and `.backtrace()`), you can be sure this is from the analyzed app, and know the exact location. A new limitation is then that all relevant networking APIs need to be instrumented.
 profiles: [L1, L2]

diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md
@@ -3,8 +3,8 @@ title: Using low-level APIs (e.g. Socket) to set up a custom HTTP connection
 platform: android
 id: MASTG-TEST-0239
 type: [static, code]
-weakness: MASWE-0050
+weakness: MASWE-0026
 status: placeholder
-note: This test could also be for MASWE-0049 but we'd need to support multiple weaknesses.
+note: This test could also be for MASWE-0047 but we'd need to support multiple weaknesses.
 profiles: [L1, L2]
 ---
Original file line number	Diff line number	Diff line change
Expand Up		@@ -8,4 +8,4 @@ knowledge: [MASTG-KNOW-0007]

		Ensure the debuggable flag in the AndroidManifest.xml is set to `false` for all release builds.

		Note: Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0101 for detailed guidance.
		Note: Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0064 for detailed guidance.