8 ms·

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should u

by kb120 12y ago

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

jamroom 12y ago
Most "normal" people assume whatever browser comes with Android is "Google's Browser" (right or wrong), so this could be a very big deal to A LOT of people. How many Android handset manufactures have shipped units with the AOSP browser as the default?
untog 12y ago
"a browser that isn't supported by Google" But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android <=4.3 accounts for 75% of Android users: https://developer.android.com/about/dashboards/index.html?utm_source=ausdroid.net https://developer.android.com/about/dashboards/index.html?ut... Just because Google decided not to support it any more doesn't mean they shouldn't. Pointing out Firefox and Opera is all very well, but this is the default browser on Android <=4.3, and very few users explore alternative browsers (Chrome being the exception, to a point). It's also the browser engine used in embedded webviews, don't forget.
- kb120 12y ago
  Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.
  - untog 12y ago
    Alt browsers are often the first app the people download. Which people? I'll grant that Chrome is an exception, given that it's bundled, but I've never seen usage number of other alternative Android browsers hit any meaningful numbers.
  - EpicEng 12y ago
    Who, engineers? Certainly not my wife or anyone else I have ever met who isn't technical.
    - andrewstuart2 12y ago
      Haha, I'm sure we've all had tunnel vision moments at one point or another.
    - kb120 12y ago
      My grandmother managed to switch entirely to Chrome on her PC without the help of anyone in our family. Anecdotal evidence works both ways. It isn't 1998. Most people know what a browser is and which one they are using on their desktop. Making the leap to a second browser on a phone (where they can easily get it from Google Play) isn't that ridiculous.
      - EpicEng 12y ago
        Who's talking about PC? We're talking about phones here, and it is different. Also, it's not anecdotal; we have data. The only reason that IE still has such a large share of the browser market is because people are unaware of and/or don't care about other (better) options.
      - threeseed 12y ago
        Not sure what fantasy land you're living in. But most people are not downloading alternate browsers en masse for their phone. Especially not when there isn't a compelling reason to do so.
      - JetSpiegel 12y ago
        Chrome on Desktop has adapted several malware techniques to get installed without the user noticing. Bundled by default in many installers, including Flash, installs with user permissions only.
        judk 12y ago
        Example? I worked quite hard to get my grandma to install Chrome.
  - gregors 12y ago
    I've played tech support to many people in my circle of friends and family who have no idea that alternate browsers even exist. The vast majority of users use what comes on the phone by default.
- ufmace 12y ago
  Could they update it, though? I thought part of the reason they went to Chrome is that the AOSP browser is baked into the OS and so not updateable without updating the whole OS. So to patch it, they'd have to update the OS, but if you're doing that, then why not just move to the latest OS, which is already fixed?
  - guelo 12y ago
    Yes they can update it. Android provides an update mechanism for system apps.
    - zmmmmm 12y ago
      They can update the "Android Browser" app, but the flaw is in a system level component (the Android WebView). They might be able to mitigate the flaw with an update to the app, but all other applications (including any OEM shipped browser that utilises the system web view) would still be vulnerable.
      - meowface 12y ago
        I imagine this would be fixable with an Android OS patch, no? I think this is critical enough to warrant that.
  - cpeterso 12y ago
    Chrome only supports Android 4.0+ (Ice Cream Sandwich), so people with older Android devices don't have that choice. OTOH, Firefox supports Android 2.3+ (Gingerbread). Mozilla only recently dropped Froyo support.
sitkack 12y ago
So on 90% of phones when someone opens "the web" using the browser installed on their device, they are using an unsupported browser. How would they know this?
- kb120 12y ago
  Only 20% of mobile web traffic comes from ASOP browser.
  - gress 12y ago
    That's because most web traffic comes from iOS. AOSP Browser represents about half of the Android traffic.
    - just_testing 12y ago
      Well, not everywhere. Here in Brazil, Androids have the (by a huge margin) biggest share of the market and of the mobile traffic.
      - ZoF 12y ago
        They are clearly talking about normalized global metrics. Obviously things aren't the same everywhere...
  - worklogin 12y ago
    That's 1 in 5 mobile users! How can you argue that 20% is small?
    - magicalist 12y ago
      > How can you argue that 20% is small? where did they argue that? They were just correcting the 90% claim above.
      - jsmthrowaway 12y ago
Tloewald 12y ago
Even if we accept your dismissal of this issue, and I sure don't, this is indicative of Android's issues as a platform. Massive vulnerability affecting huge proportion of installed base is ignored by vendor.
serve_yay 12y ago
Pretty much the tone-deaf reaction I was expecting. Thanks! (Of course, these devices will still be counted by those touting Android's market share. Surprise surprise)
- revscat 12y ago
  And this is where platform evangelism/favortism morphs from the merely annoying to the (potentially) dangerous.
rsync 12y ago
"So the bug is only for a browser that isn't supported by Google?" Wait, what ? I'm not an android user, but I am a chrome user on all of my desktops ... can someone enlighten me ? How is chrome not a browser supported by google ?
- chadzawistowski 12y ago
  AOSP Browser is the unsupported one. Google deprecated it in favor of Chrome.
  - Pxtl 12y ago
    But AOSP is still a core part of the android OS because it's used by every app that wishes to render a page.
    - quarterto 12y ago
      In 4.4, WebView is backed by Chromium.
  - gcb0 12y ago
    "deprecated" while there are still millions of consumers whose products only run 2.3.3 with enough memory for aosp browser (which they cant even uninstall) google logic. ...or better yet, san francisco dev logic
- spydum 12y ago
  This is not a bug in Chrome, but a bug in AOSP which was the browser shipped with android before Chrome became the default.
27182818284 12y ago
>. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Recalls happen in older cars still. Maybe since it is 2014, we think about a similar idea with software involving millions of users.

by kb120 12y ago

jamroom 12y ago

Most "normal" people assume whatever browser comes with Android is "Google's Browser" (right or wrong), so this could be a very big deal to A LOT of people. How many Android handset manufactures have shipped units with the AOSP browser as the default?

untog 12y ago

"a browser that isn't supported by Google" But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android <=4.3 accounts for 75% of Android users: https://developer.android.com/about/dashboards/index.html?utm_source=ausdroid.net https://developer.android.com/about/dashboards/index.html?ut... Just because Google decided not to support it any more doesn't mean they shouldn't. Pointing out Firefox and Opera is all very well, but this is the default browser on Android <=4.3, and very few users explore alternative browsers (Chrome being the exception, to a point). It's also the browser engine used in embedded webviews, don't forget.

kb120 12y ago
Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.
- untog 12y ago
  Alt browsers are often the first app the people download. Which people? I'll grant that Chrome is an exception, given that it's bundled, but I've never seen usage number of other alternative Android browsers hit any meaningful numbers.
- EpicEng 12y ago
  Who, engineers? Certainly not my wife or anyone else I have ever met who isn't technical.
  - andrewstuart2 12y ago
    Haha, I'm sure we've all had tunnel vision moments at one point or another.
  - kb120 12y ago
    My grandmother managed to switch entirely to Chrome on her PC without the help of anyone in our family. Anecdotal evidence works both ways. It isn't 1998. Most people know what a browser is and which one they are using on their desktop. Making the leap to a second browser on a phone (where they can easily get it from Google Play) isn't that ridiculous.
    - EpicEng 12y ago
      Who's talking about PC? We're talking about phones here, and it is different. Also, it's not anecdotal; we have data. The only reason that IE still has such a large share of the browser market is because people are unaware of and/or don't care about other (better) options.
    - threeseed 12y ago
      Not sure what fantasy land you're living in. But most people are not downloading alternate browsers en masse for their phone. Especially not when there isn't a compelling reason to do so.
    - JetSpiegel 12y ago
      Chrome on Desktop has adapted several malware techniques to get installed without the user noticing. Bundled by default in many installers, including Flash, installs with user permissions only.
      - judk 12y ago
        Example? I worked quite hard to get my grandma to install Chrome.
- gregors 12y ago
  I've played tech support to many people in my circle of friends and family who have no idea that alternate browsers even exist. The vast majority of users use what comes on the phone by default.
ufmace 12y ago
Could they update it, though? I thought part of the reason they went to Chrome is that the AOSP browser is baked into the OS and so not updateable without updating the whole OS. So to patch it, they'd have to update the OS, but if you're doing that, then why not just move to the latest OS, which is already fixed?
- guelo 12y ago
  Yes they can update it. Android provides an update mechanism for system apps.
  - zmmmmm 12y ago
    They can update the "Android Browser" app, but the flaw is in a system level component (the Android WebView). They might be able to mitigate the flaw with an update to the app, but all other applications (including any OEM shipped browser that utilises the system web view) would still be vulnerable.
    - meowface 12y ago
      I imagine this would be fixable with an Android OS patch, no? I think this is critical enough to warrant that.
- cpeterso 12y ago
  Chrome only supports Android 4.0+ (Ice Cream Sandwich), so people with older Android devices don't have that choice. OTOH, Firefox supports Android 2.3+ (Gingerbread). Mozilla only recently dropped Froyo support.

sitkack 12y ago

So on 90% of phones when someone opens "the web" using the browser installed on their device, they are using an unsupported browser. How would they know this?

kb120 12y ago
Only 20% of mobile web traffic comes from ASOP browser.
- gress 12y ago
  That's because most web traffic comes from iOS. AOSP Browser represents about half of the Android traffic.
  - just_testing 12y ago
    Well, not everywhere. Here in Brazil, Androids have the (by a huge margin) biggest share of the market and of the mobile traffic.
    - ZoF 12y ago
      They are clearly talking about normalized global metrics. Obviously things aren't the same everywhere...
- worklogin 12y ago
  That's 1 in 5 mobile users! How can you argue that 20% is small?
  - magicalist 12y ago
    > How can you argue that 20% is small? where did they argue that? They were just correcting the 90% claim above.
    - jsmthrowaway 12y ago

Tloewald 12y ago

Even if we accept your dismissal of this issue, and I sure don't, this is indicative of Android's issues as a platform. Massive vulnerability affecting huge proportion of installed base is ignored by vendor.

serve_yay 12y ago

Pretty much the tone-deaf reaction I was expecting. Thanks! (Of course, these devices will still be counted by those touting Android's market share. Surprise surprise)

revscat 12y ago
And this is where platform evangelism/favortism morphs from the merely annoying to the (potentially) dangerous.

rsync 12y ago

"So the bug is only for a browser that isn't supported by Google?" Wait, what ? I'm not an android user, but I am a chrome user on all of my desktops ... can someone enlighten me ? How is chrome not a browser supported by google ?

chadzawistowski 12y ago
AOSP Browser is the unsupported one. Google deprecated it in favor of Chrome.
- Pxtl 12y ago
  But AOSP is still a core part of the android OS because it's used by every app that wishes to render a page.
  - quarterto 12y ago
    In 4.4, WebView is backed by Chromium.
- gcb0 12y ago
  "deprecated" while there are still millions of consumers whose products only run 2.3.3 with enough memory for aosp browser (which they cant even uninstall) google logic. ...or better yet, san francisco dev logic
spydum 12y ago
This is not a bug in Chrome, but a bug in AOSP which was the browser shipped with android before Chrome became the default.

27182818284 12y ago

>. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Recalls happen in older cars still. Maybe since it is 2014, we think about a similar idea with software involving millions of users.