22

There are a load of sites that do this now, and it's really annoying:

  • I visit a content site on my Android device.
  • 10-15 seconds after loading starts the site hangs for a few seconds.
  • Google play store loads with a garbage app (usually some awful FTP or useless battery app) pre-selected.

This appears to be because a dodgy ad-script (i.e. Javascript running in the web page) is somehow able to redirect my device to open a link to an application in the store without me selecting it directly.

I consider it to be a critical security fail that Android lets this happen, but then Iphones do the exact same thing (but hang for much longer opening the app store).

This isn't me accidentally clicking on anything - the site loads, then the play-store redirect fires, every time.

Is there any way to stop this? Any option I can set in the store or browser to stop this incredibly annoying behaviour?

I'm on a Nexus 7, but I've seen this on lots of other Android devices.

  • To be clear, this is a browser feature that calls a system (Android) "hook". – user66001 Sep 12 at 16:15
  • @user66001 This is a 5 year old issue, I'm fairly sure it was due to JS being allowed to execute non HTTP protocols (without user interaction) that's long been blocked by better CORS. This was a massive pain in 2014, I don't think I've seen it for years. – Keith Sep 13 at 20:36
11

You can't stop websites redirecting you to other sites: that's just how the web works. What you can do is stop links to apps on Google Play opening in the Play Store app.

Android 6 (Marshmallow):
From the main device settings, go to Apps, then find Google Play Store in the list, click Open by default, then Open supported links, then Don't open in this app.

Older Android:
From the main device settings, go to Apps, then find Play Store in the list, and click Clear defaults.
Next time a website redirects you to a Google Play link, you'll get a chooser asking you whether to open it in the browser (it'll give you a choice of browsers if you have several installed) or with the Play Store app. Select the web browser and click Always. Now links to Google Play will never open in the Play Store app.

Note that this isn't a security problem, whichever behaviour you choose. Web links can only open apps on the device if (1) the app specifically says it can understand/handle that kind of link; and (2) the app specifically says that it's safe to access it in that way from the web. The app does this using an intent filter marked with the browsable category.

  • 2
    I'm fine with a link that I click on opening the app - that's useful behaviour. What I have a problem with is it opening the app-link when I haven't selected it. This is a security problem as web pages should not be able to do a cross-origin redirect without user intervention (which is why malware sites attempt click-jacking to achieve a similar effect). I think that's why your workaround works - Chrome (correctly) disallows the cross-origin web-request while Android (incorrectly) allows the cross-app one. – Keith Jan 30 '14 at 14:16
  • I'd try Dan's approach with a slightly different last step then: Instead of selecting the browser as new default, simply hit the "back" button when the popup comes. That should abort the action. Side-effect then is you'll always have that pop-up, and must select the target app manually each time. Only other way is avoiding those sites, and optionally leaving a corresonding comment to the webmaster/service/whatever-contact-given. – Izzy Jan 30 '14 at 14:33
  • @Keith It's perfectly normal for a site to redirect to a different domain. The same thing happens when you use a shortened URL, or click on a Google search result. It would only be a security problem if the app let you take some action (such as installing the app) from the link without further intervention. – Dan Hulme Jan 30 '14 at 14:37
  • @DanHulme when you click on a search result that's a user-initiated action. URL shortening services return a header that redirects the browser. Both of these are ok. However you can't have a script loaded in the page that redirects the user to another page on a different domain - if you could loading a page full of ad-redirects would launch loads of new pages or pop-ups (like the bad old days on the PC). All the newer browsers implement some kind of CORS to avoid that. This is a CORS security failure at the Android OS level. – Keith Jan 30 '14 at 15:35
  • @Keith I'm not sure why you think the Android OS decides whether to follow the link or not. It's entirely up to the web browser. Only the web browser has the information about whether the action was user-initiated or not, and whether the referrer and the target share a domain or not. – Dan Hulme Jan 30 '14 at 17:16
4

I take it since you never mentioned it that your unrooted and using stock browser (chrome).

The solutions i can think of, disable javascript, install alternative browser for example Firefox which has an adblock addon or root your device and use something like adaway.

  • It's getting annoying enough that I'm considering it, but I don't really want to have to root the tablet. – Keith Jan 30 '14 at 14:20
  • Without rooting you're limited to options for adblocking. I would try the alternative browser route. Unfortunately since Google is a company which relies on advertising it has removed all ad blocking apps from the play store, while i understand their position it leaves mobile browsing open to abusive practices. Hope you find a solution. – mickc1306 Jan 30 '14 at 14:27
  • @mickc1306 that's very true, over 90% of their revenue is advertising, it is NOT in their interest to allow you to block ads. The very reason I rooted was AdAway to be honest. It also removes the ad frame from some apps so they are nice and full screen again. Now I just root out of the box pretty much. Once you get used to removing bloatware and ads, it's hard to go back! – RossC Jan 30 '14 at 15:22
  • 1
    I came here because firefox on android experiences this same behavior. – Scott Apr 12 at 12:01
  • This behaviour has nothing to do with Ads. The website is loading a protocol (i.e., URL, CALLTO, etc) which the browser is then passing to a default action on the system (Android/iOS/etc). Stop the browser from doing anything with that protocol (or not through JS means/without prompting) or stop the OS's association between protocol and action (though this latter will disable other apps using the same functionality from launching the app store), and problem is solved. – user66001 Sep 12 at 16:21
0

You don't need root to stop this dead in its tracks.

adblockplus.org

Is not on the play store. Its 100% free and works flawlessly. Has several options. Ability to block all ads or just ones like these annoying redirects xploits we talk about here.

And it's a browser security issue not an android os issue.

  • 1
    It is a Android OS issue. -1 – HasH_BrowN Dec 11 '14 at 16:56
  • 1
    Is developer friendly. By default is set to only block intrusive adverts like the ones discussed here. I only use it for blocking intrusive adverts. And full screen adverts that attempt tap jacking. I'm sorry if your a developer that uses such advertising methods in your software applications but I won't ever change in my beliefs. – marty3 Jan 4 '15 at 8:29
  • 2
    @RyanConrad I agree with ads in principal but as a developer do you really think someone who is in the middle of reading a FB article on (funny cats/txts/whatever) will actually be happy with their forced redirection to the playstore in the middle of reading? Then they have to go back & try to find where they were and hope they don't get kicked back over again...do you think any of these people will actually be in any good mood to download the battery app or F2P game? Remember, it's not like an ad on a traditional webpage – Ben-Jamin Apr 2 '15 at 13:39
  • 2
    Exactly. @Ben-Jamin. And Adblockplus does just that. It doesn't 'steal revenue' as Ryan Conrad mentioned at all. It just stops intrusive adverts. Tap jacking attempts. And if your a developer that impliments such vicious methods of advertising for revenue should be shot. And the reason Google don't have any ad blocking software on play store is because it goes against everything that Google are. What you think Google comes from. Lol. Without adverts Google is nothing. Adverts is Google main source of income.it always has beenGoogle are to blame for such adverts on th Internet.not a bad thing – marty3 Aug 10 '15 at 9:47
  • 1
    @RyanConrad I'm happy with ads, they aren't the problem. The problem is ad scripts that stop me browsing, vibrate the phone, pop a dialog and then redirect me to the app store. I want to support developers using the ad supported model, I do, but with ads running rampant don't really have another option. These dark patterns must work for some poor dupes that end up with malware installed, but for me any app that is advertised to me with this kind of script guarantees I will never install it and warn my friends not to either. Android needs to close the security hole. – Keith Jun 1 '16 at 6:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.