This is in reference to the vulnerability that Google is not patching, since the WebView in 4.3 and less is part of the OS and not a separate updateable component.

Since some people will not have easy upgrade options from their phone manufacturer or cell carrier, they might consider just staying with 4.3, or some are still hoping their carrier provides an upgrade at some point. In this case it's useful to understand what one can do to mitigate the risk of the vulnerability.

Is this a vulnerability that any website can exploit just by visiting the website with the standard web browser? I.e. if I go to someverymalicioussite.example.com and it contains specific javascript that targets the vulnerability and allows remote code execution.

If so, is that risk mitigated by using a browser like Firefox or Chrome (that I am guessing does not use the WebView component).

Or does the vulnerability require installing an app that a developer has maliciously written to exploit the Web View component, to allow the app to perform actions that it wasn't permitted to?

  • 1
    I don't think it's been publicly disclosed. The blog post sourced by most articles about the issue implies that the vulnerability was only reported to the Android security team via email. Commented Jan 15, 2015 at 2:15

1 Answer 1


While this is getting attention by the media only now there is already one exploit in Metasploit that explore this vulnerability.

The "single-click" Metasploit exploit targets a vulnerability in a WebView component that's used by the native Android browser, although the component can also be used by other apps.

According to an attack-demonstration video published by Rapid7, the bug can be exploited by tricking a user into scanning a malicious QR code that includes the attack code, which then triggers the vulnerability in the Android browser and gives the attacker command-shell access to the device.

But the vulnerability can be exploited in other ways, too. "A secondary attack vector involves the WebViews embedded inside a large number of Android applications," says an overview published by Rapid7. "Ad integrations are perhaps the worst offender here." In particular, if an attacker could gain man-in-the-middle access to a vulnerable application's HTML connection, or to the cross-site scripting code used by the application, then the attacker could inject the malicious JavaScript code and gain command-shell access to the device.

How to defend against that? As almost anything that harden android you will need root then do :

  1. Completely delete the stock browser using your favorite app or delete the stock browser app and odex correspondent file (for advanced users)

  2. Block all ads entirely giving no chance to an man-in-the-middle intercept and change ads displayed by apps with malicious code. Adaway is a good free open source app that can help and it's avaible via F-Droid.

  3. Using firefox chrome or safari should be safe but if you want even more security and don't really care about breaking some pages make sure Javascript is disabled (no root needed for this step) this will protect you against a large quantity of attacks.

  • 1
    Could you add the reference link? I guess this page on rapid7.com is the one?
    – Andrew T.
    Commented Jan 15, 2015 at 3:49
  • 1
    Yes , also from here darkreading.com/mobile-security/…
    – Freedo
    Commented Jan 15, 2015 at 3:54
  • This sounds related to apps which enabled native javascript bridges on the web view component? Which enables javascript to make make native Java calls: labs.mwrinfosecurity.com/blog/2013/09/24/…
    – AaronLS
    Commented Jan 15, 2015 at 3:54
  • Yes @AaronLS yes it is related i assumed the safest option is to block all ads entirely the tips to defend against that you won't see on net because i have come to that by myself
    – Freedo
    Commented Jan 15, 2015 at 4:01
  • I'm pretty sure this is a different bug. The article has a link to the fix in AOSP, whereas the one that's been seeing coverage recently is, according to the article I linked in my previous comment, not going to be fixed at all. Either that or the new one would have to be an extension of the old attack, but I've not seen any sources that state that. Commented Jan 15, 2015 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .