Swedish researchers: biggest car security flaws lie in apps and the cloud

Modern cars are "computers on wheels", and their weak point is increasingly not the vehicle itself but the services around it. That is the finding of researchers at the University of Gothenburg and Chalmers University of Technology in Sweden, published in the Software Quality Journal. The Polish tech site Antyweb reported on it on 30 October 2026.

What the researchers found

The Swedes analysed vulnerabilities in automotive software reported to the US National Vulnerability Database (NVD). The largest share, 36.2%, involved external mobile apps, web platforms and cloud services rather than components of the car.

In practice, as Antyweb describes it, an attacker does not need to plug into the on-board computer or break the car's Wi-Fi module. A flaw in a manufacturer's server holding driver profiles, or a bug in a phone app, can be enough. Such an attack could allow someone to track a vehicle's GPS location remotely and unlock its doors. In extreme cases it could also give control over on-board systems.

Vulnerable open-source libraries

The researchers used five professional security scanners to check 20 popular open-source projects used in the automotive industry. They found 827 libraries with vulnerabilities. According to Antyweb, the problem stems partly from rushed schedules around model launches and from reliance on ready-made open-source solutions.

The same libraries are widely used, so a single flaw can affect many models, and even different manufacturers. Another issue is network segmentation inside the car, meaning the separation of systems by digital barriers. Without it, breaking into something like the radio could open the way to systems that control the engine or the adaptive radar. The researchers stress that not every flaw allows such a serious scenario. They also report that 17 of the vulnerabilities found are being actively exploited by cybercriminals.

What drivers can do

Antyweb lists three basic pieces of advice:

• install vehicle software updates promptly, as patches may contain important security fixes,
• set a strong, unique password for the app linked to the car and change it periodically,
• check in the app which third-party services have been given access to the car's location data.

What this means for you

The study is not specific to any country and does not name brands or models. However, it concerns software widely used across the industry, so the advice in the article can also apply to cars used in the UK. This is especially true for vehicles that can be controlled from a phone.