Systematic Analysis of Smartphone Architectural Security: A Multi-Layered Vulnerability Assessment of Android and iOS Ecosystems (2020-2025)

Android and iOS constitute the major smartphone players on the world stage, but there is still limited knowledge on their architectural security flaws. This paper is a multi-layered vulnerability evaluation of the Android and iOS platform on the basis of vulnerabilities that are publicly disclosed between 2020 and 2025. A total of 5647 vulnerabilities were analyzed, of which 3192 are for Android and 2455 are for iOS. Vulnerabilities were assigned to a structured architectural security model that includes hardware and firmware, kernel and operating system core, system services and middleware, application framework, and ecosystem and update mechanisms. The results show that vulnerabilities are disproportionately distributed across the various layers of the architecture, with the kernel layer, system services, and application framework layers contributing to the greatest number of disclosures with the highest severity levels. More than half of all the reported issues are cross-layer vulnerabilities which illustrate the weakness of a rigid layer isolation. Platform-specific differences in vulnerability concentration and patch latency distributions as one of the comparative analysis indicators portray different architectural design and ecosystem governance models. This paper places vulnerabilities into their own architectural context to offer a longitudinal and comparative overview of systemic security risk, which can be applied to platform designers, researchers and security practitioners aiming to enhance smartphone architectures.