The Tangled Webview - Javascriptinterface Once More
Explore a critical security vulnerability in Android's WebView component in this 22-minute Black Hat conference talk. Delve into the risks associated with the addJavascriptInterface method, which allows native applications to interact with web pages. Learn about a novel class of WebView vulnerabilities that can bypass all existing verifications, including those implemented to address previous issues like CVE-2012-6336 and App Clone Attack. Discover a new attack model presented for the first time, and gain insights into the potential security implications for Android applications using WebView. Presented by Ce Qin, this talk offers valuable information for mobile security researchers, Android developers, and cybersecurity professionals looking to understand and mitigate risks in mobile application development.