Chaos of Functionalities: Understanding Security Risks in Heterogeneity of IoT Matter Controllers

The Matter protocol has rapidly become the new standard for secure and interoperable IoT connectivity, adopted by major industry players and integrated into millions of devices. A core feature of Matter is its ability to support device sharing across users and controllers. However, as vendors independently implement Matter and blend it with their proprietary ecosystems, significant inconsistencies emerge. These inconsistencies result in heterogeneous user capabilities depending on which Matter Controller (MC) or OEM app is used, introducing a new and largely unexplored class of security risks. In this work, we present the first systematic study on security risks stemming from heterogeneous Matter controller implementations in shared device environments. We analyze 18 major IoT vendors and uncover a novel category of vulnerabilities, which we term MCG (Matter Controller Gaps), where differences in controller capabilities can enable unauthorized access or stealthy device manipulation. To uncover these flaws at scale, we develop MCG-Checker, a semi-automated analysis tool that combines large language models and UI automation to detect control disparities across Matter controllers and OEM apps. Using MCG-Checker, we evaluate 14 Matter controllers and 8 OEM apps, discovering 5 previously unknown attack vectors affecting top vendors such as Google, Apple, and Amazon Alexa. Our work reveals critical design and implementation issues in current Matter deployments. We offer concrete recommendations for protocol designers, vendors, and end users to address these gaps, contributing to more secure and predictable IoT ecosystems.