  Android is nowadays the most popular operating system in the world, not only
in the realm of mobile devices, but also when considering desktop and laptop
computers. Such a popularity makes it an attractive target for security
attacks, also due to the sensitive information often manipulated by mobile
apps. The latter are going through a transition in which the Android ecosystem
is moving from the usage of Java as the official language for developing apps,
to the adoption of Kotlin as the first choice supported by Google. While
previous studies have partially studied security weaknesses affecting Java
Android apps, there is no comprehensive empirical investigation studying
software security weaknesses affecting Android apps considering (and comparing)
the two main languages used for their development, namely Java and Kotlin. We
present an empirical study in which we: (i) manually analyze 681 commits
including security weaknesses fixed by developers in Java and Kotlin apps, with
the goal of defining a taxonomy highlighting the types of software security
weaknesses affecting Java and Kotlin Android apps; (ii) survey 43 Android
developers to validate and complement our taxonomy. Based on our findings, we
propose a list of future actions that could be performed by researchers and
practitioners to improve the security of Android apps.
