Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041)
by joev_ on Monday September 15, 2014 @07:12PM
(#8322118)
I wish I had tested this sooner, but yes, Webview is vulnerable (use document.write(document.domain) instead of alert() to test). So afaict apps that embed webview/ads on < 4.4 are at risk.
[ Parent
| on HN ]
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041)
by ClashTheBunny on Tuesday September 16, 2014 @02:05AM
(#8323254)
How would this be exploited? Can you read the contents of a webview in another process? Your users would have to navigate somehow to an exploited page (via an ad)?