LiteScope: Revealing the Security Paradox of Android Lite Apps in Resource-Constrained Ecosystems
Abstract
Android lite apps are intended for resource-constrained environments and are commonly assumed to be safer because they expose less functionality than full-featured apps. However, recurring reports of crashes, broken features, and excessive advertising suggest that this assumption may be false. We present the first systematic differential study of Android lite apps on an artifact-complete cohort of 500 lite-full app pairs across a diverse set of app categories. The results reveal a fundamental security paradox: lite apps simplify little in practice, yet often inherit substantial risk from their full counterparts while introducing new problems of their own. On this unified 500-pair subset, the median APK size ratio is 0.99, yet 47.0% of lite apps are actually larger than their full counterparts, while still retaining 71–91% of exported attack-surface components. We further identify 130 unique lite-app crashes, including 61 logic modification failures, 40 validation omissions, and 29 residual code hazards. These failures are not confined to niche apps: the affected lite apps account for at least 633.1 million lower-bound installs in our retained market metadata, and physical-device replay reproduces immediate lite-only fatal launch failures in at least 6 of the 45 crash-app pairs whose lite and full APKs both install on a current device. The same pattern appears in the surrounding security ecosystem: lite apps more often declare ad support, embed ad libraries, and fall into our adware-only category than full apps. In addition, 27.2% of lite apps introduce dangerous permissions absent in their full counterparts. These findings indicate that lite apps often amplify, rather than reduce, risk for the users they are meant to serve, especially in emerging markets. We conclude with recommendations for developers, marketplaces, and researchers, and release our dataset and analysis artifacts to support future work on this underexplored threat landscape.