  The super app paradigm, exemplified by platforms such as WeChat and AliPay,
has revolutionized the mobile app landscape by enabling third-party developers
to deploy add-ons within these apps. These add-ons, known as miniapps, leverage
user data hosted by the super app platforms to provide a wide range of
services, such as shopping and gaming. With the rise of miniapps, super apps
have transformed into "operating systems", offering encapsulated APIs to
miniapp developers as well as in-app miniapp stores for users to explore and
download miniapps. In this paper, we provide the first systematic study to
consolidate the current state of knowledge in this field from the security
perspective: the security measures, threats, and trade-offs of this paradigm.
Specifically, we summarize 13 security mechanisms and 10 security threats in
super app platforms, followed by a root cause analysis revealing that the
security assumptions still may be violated due to issues in underlying systems,
implementation of isolation, and vetting. Additionally, we also systematize
open problems and trade-offs that need to be addressed by future works to help
enhance the security and privacy of this new paradigm.
