Analyzing Android Browser Apps for file:/ / Vulnerabilities

Abstract. Securing browsers in mobile devices is very challenging, be-cause these browser apps usually provide browsing services to other apps in the same device. A malicious app installed in a device can potentially obtain sensitive information through a browser app. In this paper, we identify four types of attacks in Android, collectively known as FileCross, that exploits the vulnerable file:/ / to obtain user’s private files, such as cookies, bookmarks, and browsing histories. Our study shows that this class of attacks is much more prevalent and damaging than previ-ously thought. We design an automated system to dynamically test 115 browser apps collected from Google Play and find that 64 of them are vul-nerable to the attacks. Among them are the popular Firefox, Baidu and Maxthon browsers, and the more application-specific ones, including UC Browser HD for tablet users, Wikipedia Browser, and Kids Safe Browser. A detailed analysis of these browsers further shows that 26 browsers (23%) expose their browsing interfaces unintentionally. In response to our reports, the developers concerned promptly patched their browsers by forbidding file:/ / access to private file zones, disabling JavaScript execution in file:/ / URLs, or even blocking external file:/ / URLs. We employ the same system to validate the nine patches received from the developers and find one still failing to block the vulnerability.