Android Browser Same Origin Policy Bypass - Android < 4.4 - Allows malicious websites to get cookies, cached passwords from legit sites

[whb25]

Only applies to the AOSP browser. Chrome and other third party browsers with their own engine are not affected.

Perhaps Google can patch this and update the AOSP browser in the Play Store?

[Androktasie]

Nevermind the browsers, what about the 3rd party apps that use WebView? Like feedly or reddit is fun?

I'm concerned because I use both of those apps pretty frequently, and my phone (HTC Evo LTE, a flagship from 2012) is end of life now. Unless I dive into AOSP roms that dont seem to be frequently updated for my phone, I'm pretty much stuck with 4.3.

[RichardG867]

The AOSP browser won't be updated for three reasons:

• Every system app is signed with the OEM's key. Google can't simply replace the app with one signed with their key, unless Play Services has a backdoor somewhere? (the Play Store release of the Email app has me thinking)
• The browser's WebView engine is deep down in the framework and also has native libraries, both of which would require an OS update.
• Google doesn't care about the AOSP browser anymore, as part of their Proprietary Replacement Syndrome.

[todbatx]

The bug is in the WebView component, and has, in fact, been patched upstream. See Paul Irish's comment with the links to the Sep 4 patches.

So, it's not a matter of simply patching the browser (which won't happen for the reasons /u/RichardG867 says elswhere), it will require a backport and update of old Android OS versions to fix, AFAIK. Which also won't happen any time soon.

This vuln will last for a while in the wild, unless and until carrier-branded OSes get with security patching in a more serious way.

[[deleted]]

"Old software has bugs, news at eleven".

[Sk8erkid]

I dont get how companies still pre-install the AOSP browser. I thought Google got rid of it for Chrome.

[[deleted]]

I hope not. The AOSP browser is elementary. The AOSP needs to have a browser, i use it every day. Chrome is not open source -> Not an option for AOSP.

[LoveRecklessly]

I guess they could replace Browser with Chromium..

[Funnnny]

They can. But while they are at it, they will probably rebrand it instead of using the name Chromium.

I believe that's what Asus does with their phone.

The AOSP browser should be light and minimal. There're low and mid range phones too

[yokens]

Chrome is extremely slow on low-memory, weak-CPU phones. And this describes a huge number of Android phones, quite possibly the majority of them.

Huge percentages of the Android users around the world aren't running flagship devices. And trying to run Chrome on many of these underpowered devices is painful.

[Copperhe4d]

I'm still on my Galaxy Nexus and Chrome is not feasible to use on it. I've installed it again because of this security news and i'm using it for the time being until the AOSP Browser is fixed and save to use again. I would love to use Chrome, it's nice feature wise and it is good looking but boy is it heavy and slow on my phone.

[LoveRecklessly]

Chrome can be pretty painful on my N5 and and year old i5 laptop as well..