Later archive addition

Iframes/Popups Are Dangerous in Mobile WebView: Studying and Mitigating Differential Context Vulnerabilities

GuangLiang Yang, Jeff Huang and Guofei Gu

The paper identifies differential context vulnerabilities created when browser iframe and popup assumptions are carried into Android WebView’s different UI, navigation, and API model. DCV-Hunter finds prevalent origin hiding, message-integrity, popup-order, and navigation flaws that enable bridge abuse or phishing, and the proposed WebView changes mitigate them with about 2 ms overhead.

Record

Researcher

GuangLiang Yang, Jeff Huang and Guofei Gu

In the archive

• Added to the 2019 archive after the original list was published

Related sources

• Talk recording

Tags

• android
• webview
• iframe
• postmessage
• sop-bypass
• same-origin-policy
• ui-redress
• phishing
• javascript-bridge
• measurement-study
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of GuangLiang Yang, Jeff Huang and Guofei Gu, first published at the original source. Preserved copies are kept so the citation survives its host.