BugBazaar is an open-source Android application intentionally designed to be vulnerable for hands-on security testing and training. It includes more than 30 vulnerabilities across many categories (WebView issues, intent/deeplink flaws, IPC/exported component problems, SQL injection, insecure storage and logging, hardcoded secrets, and authentication/authorization weaknesses). See the project README for the full list.