Skip to content

MASWE-0038: Insufficient Protection of Sensitive Data from Screenshots or Screen Recordings

MAS Requirement

The app removes or masks sensitive data from its views when moved to the background, when being recorded or when a screenshot is taken.

Mappings

MASVS V1: MSTG-STORAGE-9

MASVS V2: MASVS-PLATFORM-3, MASVS-STORAGE-2

CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Overview

This weakness occurs when sensitive data displayed by an app can be captured in screenshots or screen recordings, and the app does not prevent the capture or conceal or redact the data when such protection is warranted.

Mobile platforms allow users, privileged apps, and external tools to capture screenshots or record the screen. In addition, when an app enters the background, the system may capture a snapshot of the app's current view for display in the app switcher. Sensitive content that remains visible without appropriate protection can be retained in these images or recordings.

Modes of Introduction

  • Missing Platform Screenshot Protection: Displaying sensitive fields without applying the related platform protections that can avoid the field information from appearing in screenshots or screen recordings (e.g., in Android, applying the FLAG_SECURE flag).
  • Missing Capture-State Redaction: Continuing to display sensitive information while the app or scene is being recorded, mirrored, or shared, despite the platform providing an API to detect the active capture state.
  • Excessive On-Screen Disclosure: Displaying complete sensitive values when a masked, partial, temporary, or user-initiated representation would be sufficient for the current task.

Impact

  • Compromise of Sensitive Data: Sensitive information may be retained in an image or video after the app session ends and may later be viewed, shared, synchronized, backed up, or accessed by another person or service.

Mitigations

  • Redact Sensitive On-Screen Content: Display only the portion of a sensitive value required for the current task. Mask values by default and unmask the values only for the needed actions, masking them again once they have been used for the task.
  • Anti-Screenshot Platform Protections: Apply platform protections that prevent elements containing sensitive content from appearing in screenshots or on non-secure displays (for example, in Android, applying the FLAG_SECURE flag).

Knowledge

MASTG-KNOW-0053: Screenshots MASTG-KNOW-0099: Screenshots

Tests

MASTG-TEST-0293: setSecure Not Used to Prevent Screenshots in SurfaceViews MASTG-TEST-0289: Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding MASTG-TEST-0292: setRecentsScreenshotEnabled Not Used to Prevent Screenshots When Backgrounded MASTG-TEST-0294: SecureOn Not Used to Prevent Screenshots in Compose Dialogs MASTG-TEST-0291: References to Screen Capturing Prevention APIs MASTG-TEST-0290: Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding

Best Practices

MASTG-BEST-0014: Preventing Screenshots and Screen Recording MASTG-BEST-0017: Use setSecure to Prevent Screenshots in SurfaceViews MASTG-BEST-0015: Use setRecentsScreenshotEnabled to Prevent Screenshots When Backgrounded MASTG-BEST-0018: Use SecureFlagPolicy.SecureOn to Prevent Screenshots in Compose Components