Android devices not running either the KitKat or Lollipop versions of the operating system – of which there are approximately 939 million devices – have been found to have a vulnerability in Android WebView, leaving the software open to attack. Google has been aware of the problem for months, but is yet to provide an update or patch to fix it.
The vulnerability in Android WebView allows apps to display web pages without opening a separate app window, meaning access to WebView potentially gives a hacker access to other apps and services on the phone or tablet.
Tod Beardsley of security researchers Rapid7 contacted Google regarding the matter. He was told: “If the affected version [of WebView] is before 4.4, we generally do not develop the patches ourselves, but welcome patches with the report for consideration. Other than notifying OEMs, we will not be able to take action on any report that is affecting versions before 4.4 that are not accompanied with a patch.”
“Google’s reasoning for this policy shift is that they ‘no longer certify 3rd party devices that include the Android Browser’, and ‘the best way to ensure that Android devices are secure is to update them to the latest version of Android’,” Beardsley said. “On its face, this seems like a reasonable decision. Maintaining support for a software product that is two versions behind would be fairly unusual in both the proprietary and open source software worlds.”
Source: BGR
Electronic Arts (EA) announced today that its games were played for over 11 billion hours…
Steam's annual end-of-year recap, Steam Replay, provides fascinating insights into gamer habits by comparing individual…
GSC GameWorld released a major title update for STALKER 2 this seeking, bringing the game…
Without any formal announcement, Intel appears to have revealed its new Core 200H series processors…
Ubisoft is not having the best of times, but despite recent flops, the company still…
If you haven’t started playing STALKER 2: Heart of Chornobyl yet, now might be the…