Frida remains valuable in Android assessments, but it is most useful when used to validate runtime hypotheses instead of blindly bypassing every control in the app.
WebView remains one of the most productive Android AppSec targets because hybrid apps repeatedly mix trusted native capabilities with untrusted or weakly controlled web content.
Android security research still pays off, but the best bugs now sit across APK logic, identity flows, backend APIs, SDK trust boundaries, WebView surfaces, and abuse-resistant controls such as attestation.
