The default browser in Android versions older than 4.4 has a vulnerability that allows malicious websites to bypass a critical security mechanism and take control of a user’s authenticated sessions on other sites.
“What this means is, any arbitrary website (say, one controlled by a spammer or a spy) can peek into the contents of any other webpage,” said Tod Beardsley, technical lead for the Metasploit Framework project, in a blog post Monday. “Imagine you went to an attacker’s site while you had your webmail open in another window—the attacker could scrape your email data and see what your browser sees. Worse, he could snag a copy of your session cookie and hijack your session completely, and read and write webmail on your behalf.”
The security flaw was discovered by independent security researcher Rafay Baloch, who published a proof-of-concept exploit on his blog Aug. 31. However, the bug’s disclosure remained largely unnoticed until the Metasploit team developed a module that can be used to steal authentication cookies from users who open a malicious page.
“Research and testing is still ongoing to plumb the depths of this issue,” Beardsley said. “We’d like to pin down exactly when the bug was fixed, and to determine just how widespread this vector really is. After all, pre-4.4 builds of Android account for about 75% of the total Android ecosystem today.”
Users who believe they might be affected are advised to install and use one of the other browsers available for Android such as Google Chrome, Mozilla Firefox, Dolphin Browser or Opera, which are not affected by this issue.