Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
metamask/metamask-mobile
main @ 7b70741
113
Fixes
0
CVEs
HIGH
Peak severity
21.9%
Coverage
Highlights
Auth Bypass: 42 prior fixes. Scrutinize any change in this area.
package.json: most-fixed (5 issues). Treat as high-risk during review.
53 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: External unsigned deep links could bypass redirect and security consent warnings. Enforcing strict signature validation and validation of origin parameters prevents malicious links from triggering unauthorized wallet actions.
Auth Bypass: Misconfiguration or early initialization of the BackgroundBridge allowed unverified external applications to claim privileged internal origins, leading to sensitive account leaks. Tightening origin validation and delaying bridge setup until navigation is fully committed protects active account details.
Signature Spoofing: A loose regular expression parser allowed nested JSON-RPC message values to override and spoof the high-level transaction amounts or addresses displayed in confirmation dialogs. Enforcing boundary-restricted parsing protects users against signed-data scams.