3 ms·
None of the mentioned privileges should net you a persistence though, so there's clearly still another vulnerability.
by roblabla 3y ago
None of the mentioned privileges should net you a persistence though, so there's clearly still another vulnerability.
- djbusby 3y agoAbove says access to SD card. I think that means write ability. Which means persistence.
- astrange 3y agoPersistence means you can write to something that'll cause your malware to run again after reboot, but external storage isn't enough to do that without another exploit in the boot path, right?
- tux3 3y agoAndroid has clamped down hard on access to the SD card. Chrome certainly doesn't have the special All Files Access, and on my device it doesn't even have Photos or Music, since I never use those permissions with Chrome, and Android regularly turns off permissions that haven't been used recently
- codedokode 3y agoBut smartphones are rarely rebooted so maybe you don't need persistence that much?
- tux3 3y agoYou still want priv escalation if you're trying to spy on someone. The content process can't see anything you're doing in other apps, and the browser can only access a very restricted view of the storage Living in memory or living off the land is generally a good idea, but you still want a chain of exploits anyways