A study of 413 reported software flaws in connected cars, covering 2022 through 2024, has been set against the decade before it by researchers at Chalmers University of Technology and the University of Gothenburg. External software – apps, websites and manufacturer cloud platforms – now accounts for more than a third of the total. That is close to three times the share earlier studies recorded.
Srijita Basu, a postdoctoral researcher in software engineering at both institutions, traced the shift: a decade ago the cars’ own systems supplied most of the vulnerabilities, whereas apps, websites and cloud services have since multiplied their share by roughly three.
Where the bugs sit changes what an attack looks like. A flaw in a vehicle module forces someone to reach the vehicle. A flaw in a booking site or companion app needs only a login form. Cars talk to dealer portals, charging networks, phone applications and the manufacturer’s own stack, and each handshake is a potential doorway.
The study also found reported risks are graded more severely than they once were. The data at stake is not mechanical either. Location histories, commute times and home addresses accumulate in cloud services because that is where connected features do their work.
Basu’s team points to a December 2024 disclosure, when records for about 800,000 electric cars from Volkswagen, Audi, Seat and Skoda sat openly accessible for months. GPS positions plus owner emails, phone numbers and street addresses were exposed through the upload service. The leak was closed after an ethical hacking group acted on a whistleblower tip.
For manufacturers, the finding argues against treating the vehicle as the security perimeter. Supplier contracts, app updates and cloud tenancy settings now carry as much risk as any control unit.
