insecure://: Vulnerability analysis of URI scheme handling in Android mobile browsers

Abdulla Aldoseri, David Oswald

Research output: Chapter in Book/Report/Conference proceedingConference contribution

92 Downloads (Pure)

Abstract

Uniform Resource Identifier (URI) schemes instruct browsers to conduct specific actions depending on the requested scheme. Previous research has addressed numerous issues with web URI schemes (e.g., http: and https:) both for desktop and mobile browsers. Less attention has been paid to local schemes (e.g., data: and file:), specifically for mobile browsers. In this work, we examined the implementation of such schemes in Android OS browsers, analysing the top-15 mobile browsers. As a result, we discovered three vulnerability types that affect several major browsers (including Google Chrome, Opera and Samsung Internet). First, we demonstrate an URI sanitisation issue that leads to a cross-site scripting attack via the JavaScript scheme. The problem affects Chromium browsers including Chrome, Opera, Edge, and Vivaldi. Second, we found a display issue in Samsung Internet that allows abusing data URIs to impersonate origins and protocols, posing a threat in the context of phishing attacks. Finally, we discover a privilege escalation issue in Samsung’s Android OS, leading to full read and write access to the internal storage without user consent and bypassing the Android storage permission. While this issue was originally discovered in the file scheme of the Samsung browser, utilising a combination of static and dynamic analysis, we traced the problem back to an authorization issue in Knox Sensitive Data Protection SDK. We then show that any app can abuse this SDK to obtain full access to the internal storage without appropriate permission on Samsung devices running Android 10. We responsibly disclosed the vulnerabilities presented in this paper to the affected vendors, leading to four CVEs and security patches in Chrome, Opera and Samsung Internet browser.
Original languageEnglish
Title of host publicationProceedings of MADWeb 2022
Subtitle of host publicationWorkshop on Measurements, Attacks, and Defenses for the Web
PublisherThe Internet Society
ChapterSession 1
Number of pages10
ISBN (Electronic)1-891562-78-9
DOIs
Publication statusPublished - 28 Apr 2022
EventWorkshop on Measurements, Attacks, and Defenses for the Web (MADWeb) 2022
- Virtual
Duration: 28 Apr 202228 Apr 2022

Publication series

NameProceedings of the Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb)

Conference

ConferenceWorkshop on Measurements, Attacks, and Defenses for the Web (MADWeb) 2022
Abbreviated titleMADWeb 2022
Period28/04/2228/04/22

Fingerprint

Dive into the research topics of 'insecure://: Vulnerability analysis of URI scheme handling in Android mobile browsers'. Together they form a unique fingerprint.

Cite this