TL;DR:<\/strong> OWASP released MASWE v1.0.0 on Aug. 17, 2026, the first stable version of the Mobile Application Security Weakness Enumeration and the missing middle layer between the OWASP Mobile Application Security Verification Standard (MASVS) and the OWASP Mobile Application Security Testing Guide (MASTG). Two years of beta feedback produced 78 clearly defined organized as a consistently structured set of weaknesses across all eight MASVS domains. NowSecure Platform already maps findings to MASWE IDs today, so security and compliance teams using it don\u2019t have to wait to put the new standard to work.<\/p>\n The OWASP Mobile Application Security Weakness Enumeration (MASWE)<\/a> catalogs the specific ways mobile apps go wrong on security and privacy. It sits between the two standards most security teams already know: Mobile Application Security Verification Standard (MASVS)<\/a> defines the controls an app should meet and the Mobile Application Security Testing Guide (MASTG)<\/a> defines the tests that verify them. MASWE fills the gap in between by naming the actual weakness a failed control points to.<\/p>\n MASWE has been in beta since mid-2024, and it showed. Of 119 draft entries, 89 were still placeholders, and the 30 that were finished had been written by different contributors over two years with no shared structure. Version 1.0.0 fixes that (see the full OWASP announcement<\/a>). OWASP\u2019s Mobile Application Security (MAS) Task Force consolidated the catalog down to 78 weaknesses, merging near-duplicates (nine separate \u201cunsafe handling of data from X\u201d entries became one weakness, for example), assigned stable, permanent IDs and gave every entry the same four-part structure: what the weakness is, how it gets introduced, what it costs the business if it\u2019s exploited and how to fix it.<\/p>\n That consistency matters more than it sounds like it should. With MASTG v2.0\u2019s release in June 2026, every test in the testing guide now links to a specific MASWE weakness, which links to a specific MASVS control. MASWE v1.0 is what makes that chain hold up end to end: MASVS control to MASWE weakness to MASTG test to MASTG demo.<\/p>\n For security leaders, the value isn\u2019t the taxonomy itself. It\u2019s what a stable taxonomy lets you do with it.<\/p>\n \u201cThe app failed MASVS-STORAGE-2\u201d doesn\u2019t give a developer anything to work with. But saying \u201cThe app failed MASWE-0005<\/a> because of verbose logging in production,\u201d that\u2019s a problem they can actually fix.<\/p>\n That specificity is what turns a pentest report into something a developer can fix, an auditor can verify and a CISO can point to as evidence of due diligence, using a common vocabulary that means the same thing whether the finding came from an internal test, a third-party pen test or an automated scan.<\/p>\n MASVS and MASTG are already referenced by the App Defense Alliance (ADA) Mobile Application Security Assessment (MASA) program<\/a>, CREST OVS and NIST SP 800-163r1 and SP 800-218, so ambiguity in the underlying standard becomes ambiguity in someone\u2019s compliance obligation. A well-defined weakness enumeration is built to remove exactly that kind of ambiguity.<\/p>\n NowSecure has contributed to the OWASP MAS project since 2021<\/a>, with Carlos Holguera, a NowSecure distinguished research engineer, serving as OWASP MAS project co-chair. OWASP credited Carlos in the MASWE v1.0 release notes<\/a> for driving the remapping, the consolidation and the authoring standard that kept a catalog this size internally consistent. NowSecure is also named as one of OWASP MAS\u2019s ongoing Advocates, the group of organizations OWASP recognized for sustained contribution to the project.<\/p>\n More practically for teams evaluating this today: NowSecure Platform<\/a> already tags findings with their corresponding MASWE IDs, alongside the same findings\u2019 MASVS, GDPR, HIPAA and PCI DSS mappings. A finding like \u201cApp Requests Dangerous Permissions\u201d already shows up mapped to MASWE-0066 <\/a>in the platform\u2019s Regulatory tab.<\/p>\n Teams using NowSecure Platform for continuous or on-demand mobile app security testing<\/a> benefit from the new standard without having to remap anything themselves.<\/p>\n If your organization already treats MASVS as the bar for mobile app security, the MASWE v1.0 layer makes findings against that bar traceable and specific. It\u2019s worth updating any internal scorecards or vendor requirements that currently cite only MASVS controls.\u00a0<\/p>\n For a primer on how MASVS, MASTG and MASWE fit together, see NowSecure\u2019s Essential Guide to OWASP<\/a>. Request a demo of NowSecure Platform<\/a> to see MASWE-mapped findings on your own apps.<\/p>\n<\/p><\/div>\nWhat Is OWASP MASWE v1.0?<\/h2>\n
Why Does OWASP MASWE Matter for Security and Compliance Teams?<\/h2>\n
\n
\n\t\u2018The app failed MASVS-STORAGE-2\u2019 doesn\u2019t give a developer anything to work with. But saying \u2018The app failed MASWE-0005 because of verbose logging in production,\u2019 that\u2019s a problem they can actually fix. <\/p>\n<\/blockquote>\nDoes NowSecure Platform Support OWASP MASWE?<\/h2>\n
![\"APp](\"https:\/\/www.nowsecure.com\/wp-content\/uploads\/2026\/08\/Aug-19-OWASP-MASWE-blog-body-graphic-1-960x492.png\")
<\/figure>\n<\/div>\n![\"MASWE-0066:](\"https:\/\/www.nowsecure.com\/wp-content\/uploads\/2026\/08\/Aug-19-OWASP-MASWE-blog-body-graphic-2-960x520.jpg\")
<\/figure>\n<\/div>\nWhere to Go From Here<\/h2>\n