The Tangled Webview ----- Javascriptinterface Once More
summary
Claims a new class of WebView addJavascriptInterface flaws that bypass all verifications by exploiting differences between browser‑ and renderer‑initiated navigation and timing, reproducing CVE‑2012‑6336 style risks. Describes three real exploit patterns — navigation confused via direct JS load, lifecycle redirects, and singleTask deeplink reuse — and an Androguard‑based scanner that finds instances in the wild. Builds a working mitigation called reach interface that transmits a verified URL before the Java bridge call to stop these bypasses.
AI-written summary · about
chapters (7)
- 0:00Start
- 6:10Tangled getUrl — Lifecycle-based access control
- 7:33Tangled getUrl — "real-time" access control
- 12:09Vulnerability Model#1
- 13:38Vulnerability Model#2
- 14:24Attack In Real World#2
- 15:35Vulnerability Model#3
related talks
34mOvercoming JavaScript Unsecurities in WebViews
40mSo, You Want To Use A WebView? [BAD AUDIO]
34mOvercoming Insecurities in WebViews
42mOvercoming Unsecurities in WebViews
42mDangers on Android: Vulnerabilities and Defenses
25mWebView Implementations in the 2020s
36mHTML5 JS Security
27mBypassing Browser Security Policies for Fun and Profit