The Model–View–Controller (MVC) pattern is widely adopted in Android application development to promote separation of concerns and architectural clarity. While deviations from MVC principles have traditionally been studied as maintainability or design issues, their potential security relevance has received little attention. This paper investigates whether violations of MVC separation exhibit systematic differences between benign and malicious Android applications.

We conduct an empirical study on a corpus of 3,568 Android applications (2,041 benign and 1,527 malicious) collected from AndroZoo. Using static bytecode analysis, we compute three architectural metrics that quantify view–controller separation and controller-centric UI concentration. We observe a pronounced structural divergence: benign applications exhibit consistently strong separation, whereas malicious applications concentrate UI logic within controller classes. These differences remain statistically significant after controlling for application size.

Our findings suggest that MVC violations, commonly treated as maintainability concerns, may also function as security-aware architectural smells. Rather than proposing a detection technique, this work provides early empirical evidence that architectural structure itself may carry security-relevant signals, motivating further research at the intersection of software architecture and mobile security.