2 ms·
I can't find any info about how the stock browser can be abused. All code I've seen so far abuses ad libraries that allow ads to even make calls without user in
by gcb0 13y ago
I can't find any info about how the stock browser can be abused. All code I've seen so far abuses ad libraries that allow ads to even make calls without user interaction... If you install ad based apps, you should expect that anyway.
- joev_ 13y agoFrom my testing, in stock android 3.1-4.1.2, the native browser has some java objects injected into it and is vulnerable, so any page on the internet could execute arbitrary code. You can verify yourself by downloading the SDK and trying the metasploit module on different targets. Of course with vendor patches it's anyone's guess as to what code is on a device, so it is very possible that some vendors have patched this in their older distributions. If you want to check your device, jduck put up a test script here: http://www.droidsec.org/tests/addjsif/ http://www.droidsec.org/tests/addjsif/
- gcb0 13y agoThanks. 2.3.3 cm7.1 is the only one safe here.