Hybrid applications combine web and native components, exposing specific attack surfaces: client-side vulnerabilities, insecure communication between layers, improper management of native permissions, and injection via JavaScript-native bridges. Security requires analysis of embedded web code, verification of communication channels between components, validation of data exchanged between contexts, and protection of native APIs exposed to the web layer.