Description
The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 3 modules
-
Android Open Source Platform (AOSP) Browser UXSS
auxiliary/gather/android_stock_browser_uxss
-
Android Open Source Platform (AOSP) Browser UXSS
auxiliary/gather/android_object_tag_webview_uxss
-
Android Browser RCE Through Google Play Store XFO
auxiliary/admin/android/google_play_store_uxss_xframe_rce
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 69548 vdb-entry
- http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html
- https://news.ycombinator.com/item?id=8325807
- https://android.googlesource.com/platform/external/webkit/+/1368e05e8875f00e8d2529fe6050d08b55ea4d87
- https://community.rapid7.com/community/metasploit/blog/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041
- https://android.googlesource.com/platform/external/webkit/+/7e4405a7a12750ee27325f065b9825c25b40598c
- google-android-cve20146041-sec-bypass(95693) vdb-entry
- https://news.ycombinator.com/item?id=8321185