Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by paulirish on Tuesday September 16, 2014 @01:42PM (#8325807)

Just an update from the Google side: As discussed below, any Android users on 4.4+ or running Chrome are not affected. For earlier versions of Android, we've shipped patches for AOSP:

https://android.googlesource.com/platform/external/webkit/+/... https://android.googlesource.com/platform/external/webkit/+/...

These are in the AOSP branches for jb-dev, jb-mr1-dev, jb-mr1.1-dev, and jb-mr2-dev.

[ Parent | on HN ]

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by schwarze_pest on Tuesday September 16, 2014 @09:18PM (#8327985)

Does this mean that there will be an update for the Galaxy Nexus?

[ Parent | on HN ]

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by aiiane on Wednesday September 17, 2014 @01:19AM (#8328701)

OS updates for $SPECIFIC_PHONE are generally reliant on the carrier to decide to push out a patch, even after AOSP itself is patched. So an answer "from the Google side" can't really answer your question.

[ Parent | on HN ]

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by schwarze_pest on Wednesday September 17, 2014 @01:25PM (#8331152)

The regular carrier-independent versions (Yakju/Maguro and Takju/Maguro) which are directly supported by Google.

[ Parent | on HN ]

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by junktest on Tuesday September 16, 2014 @02:03PM (#8325950)

is android kitkat 4.4.x safe from this bug regardless of whether chrome browser exists (not installed or uninstalled) in the phone or not? please enlighten. thanks.

[ Parent | on HN ]

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by joev_ on Tuesday September 16, 2014 @08:21PM (#8327831)

My understanding is that Chrome replaced Webkit in WebView's internal implementation in 4.4, so the bug should never appear in 4.4.

[ Parent | on HN ]

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by paulirish on Wednesday September 17, 2014 @02:58PM (#8331722)

Yup correct. Completely different WebView. And the bug is technically in the WebView.

[ Parent | on HN ]