Abstract
Uniform Resource Identifier (URI) schemes instruct browsers to conduct specific actions depending on the requested scheme. Previous research has addressed numerous issues with web URI schemes (e.g., http: and https:) both for desktop and mobile browsers. Less attention has been paid to local schemes (e.g., data: and file:), specifically for mobile browsers. In this work, we examined the implementation of such schemes in Android OS browsers, analysing the top-15 mobile browsers. As a result, we discovered three vulnerability types that affect several major browsers (including Google Chrome, Opera and Samsung Internet). First, we demonstrate an URI sanitisation issue that leads to a cross-site scripting attack via the JavaScript scheme. The problem affects Chromium browsers including Chrome, Opera, Edge, and Vivaldi. Second, we found a display issue in Samsung Internet that allows abusing data URIs to impersonate origins and protocols, posing a threat in the context of phishing attacks. Finally, we discover a privilege escalation issue in Samsung’s Android OS, leading to full read and write access to the internal storage without user consent and bypassing the Android storage permission. While this issue was originally discovered in the file scheme of the Samsung browser, utilising a combination of static and dynamic analysis, we traced the problem back to an authorization issue in Knox Sensitive Data Protection SDK. We then show that any app can abuse this SDK to obtain full access to the internal storage without appropriate permission on Samsung devices running Android 10. We responsibly disclosed the vulnerabilities presented in this paper to the affected vendors, leading to four CVEs and security patches in Chrome, Opera and Samsung Internet browser.
Original language | English |
---|---|
Title of host publication | Proceedings of MADWeb 2022 |
Subtitle of host publication | Workshop on Measurements, Attacks, and Defenses for the Web |
Publisher | The Internet Society |
Chapter | Session 1 |
Number of pages | 10 |
ISBN (Electronic) | 1-891562-78-9 |
DOIs | |
Publication status | Published - 28 Apr 2022 |
Event | Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb) 2022 - Virtual Duration: 28 Apr 2022 → 28 Apr 2022 |
Publication series
Name | Proceedings of the Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb) |
---|
Conference
Conference | Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb) 2022 |
---|---|
Abbreviated title | MADWeb 2022 |
Period | 28/04/22 → 28/04/22 |