Researchers from the University of Gothenburg and Chalmers University of Technology analyzed 413 reported software vulnerabilities in connected vehicles. Their findings show the risk profile has shifted toward external-facing systems. External applications account for 36.2% of identified vulnerabilities; system-on-chip and embedded hardware components represent 23.5%.
A separate scan of 20 open-source automotive software projects found 827 vulnerable libraries, a count roughly twice the size of the primary vulnerability dataset, though libraries and individual vulnerabilities are different units and should not be read as a direct comparison.
Nearly 45% of the 413 vulnerabilities carried a high-severity classification, spread across nine distinct attack vectors, according to the research paper published in Software Quality Journal.
What “Vulnerability” Actually Means for Drivers
A software weakness is not the same as a proven pathway to your brakes or steering wheel.
Three levels of risk matter here, and they are not equal. One possible consequence of an exploited connected-vehicle vulnerability is data and privacy exposure: location history, trip records, account credentials, or customer information held by a linked service. Some apps have been caught secretly tracking users at frequent intervals, illustrating how linked services can become privacy liabilities.
A step up is the theoretical possibility that a compromised external system could reach vehicle networks. That depends on authentication design and how well those networks are isolated from each other.
Direct control of safety-critical functions is the most severe scenario and requires multiple conditions to align. The researchers did not demonstrate that outcome for any of the 413 vulnerabilities they analyzed.
The Jeep Precedent Still Matters
A 2015 research demonstration proved remote vehicle compromise is possible, but skilled researchers conducted it under controlled conditions, not in a widespread real-world attack.
Security researchers Charlie Miller and Chris Valasek remotely accessed a Jeep Cherokee’s infotainment system in 2015 and demonstrated the ability to affect the transmission, steering, and brakes. Fiat Chrysler recalled approximately 1.4 million vehicles in response.
That episode confirmed the worst-case scenario is not fictional. It also required specific conditions, and skilled researchers executed it in a controlled setting.
Standard Software Problems in Non-Standard Places
SQL injection and memory corruption are not exotic automotive threats; they are common vulnerabilities now present inside connected vehicles.
Modern cars are effectively internet-connected software platforms tied to supply chains of third-party libraries and cloud services. SQL injection, privilege escalation, and memory corruption are well-understood attack types from the broader software world, now appearing in automotive contexts because vehicles use many of the same software components and attack surfaces as other connected systems.
The problem expands as manufacturers add more connected services and vehicles stay on the road for many years.
Steps Drivers Can Take
Practical habits reduce exposure at the edges, but they cannot substitute for secure design at the manufacturer level.
Drivers can take several steps to limit their exposure:
- Install manufacturer-provided software and firmware updates promptly
- Use strong, unique passwords for connected-car accounts and linked mobile apps
- Keep vehicle-linked applications updated and review their location-sharing permissions
- Respond to any manufacturer security recall or update notice
Those steps address surface exposure. Manufacturers carry the primary responsibility for secure design and meaningful isolation between infotainment and safety-critical systems. That responsibility extends to vulnerability patching across a vehicle’s full service life.
Securing the Ecosystem, Not Just the Hardware
The research signals that protecting a connected vehicle now means protecting everything it connects to.
The University of Gothenburg and Chalmers study makes a straightforward case: vehicle cybersecurity can no longer focus only on what sits inside the car. Apps, cloud services, and open-source libraries can all become part of the attack surface.
That is an engineering problem as much as a technology one, and the evidence from this study points to manufacturers as the parties best positioned to address it.
