4 ms·

Eh, calling an embedded web-view a 'screet google browser' smells a bit clickbait'ish. In situations where it bypasses things like parental control its fair to

• mrweasel 3y ago
  Perhaps not, unless there is a security vulnerability in the web-view. I think it shows that there's a problem with the usage, and implementation of web-view and it's permissions. I can see why Google wouldn't want to apply the permissions and parental contracts from the browser to the web-view, that would break a bunch of stuff and it would be hard to explain to the user that a link in the Contacts app doesn't work, because Chrome is locked down. Others would argue that is exactly what they expect to happen. In this case I fail to see why Contacts embeds its own webview, rather than just triggering the browser to open the link. Not every app needs a web-view.
  • hhh 3y ago
    This is how the current ps5 jailbreak works iirc
  • kllrnohj 3y ago
    Android's WebView is Chrome, process sandboxing & all. Unless the Contacts app injected a JS handler, which we have no evidence of, then it's no less secure than Chrome is.
• make3 3y ago
  the pinning thing looks like other applications could assume it's safe when it's not actually, which is a normal recipe for a vulnerability. worth investigating at least