An exploit of an unsupported Android browser bypasses the ever-important Same Origin Policy.

Sara Peters, Senior Editor

September 17, 2014

1 Min Read

A vulnerability in the Android Open Source Platform (AOSP) is a "privacy disaster" that affects about 75 percent of the overall "Android ecosystem" and about 100 percent of the low-end prepaid phones, according to researchers at Rapid7's Metasploit research team.

The vulnerability -- CVE-2014-6041, disclosed by Rafay Baloch -- bypasses the AOSP browser's Same Origin Policy. Yesterday, Tod Beardsley, technical lead for the Metasploit framework, wrote:

What this [vulnerability] means is, any arbitrary website (say, one controlled by a spammer or a spy) can peek into the contents of any other web page. Imagine you went to an attacker's site while you had your webmail open in another window -- the attacker could scrape your e-mail data and see what your browser sees. Worse, he could snag a copy of your session cookie and hijack your session completely, and read and write webmail on your behalf.

This is a privacy disaster. The Same-Origin Policy is the cornerstone of web privacy, and is a critical set of components for web browser security.

Not long ago, browser SOP bypasses were a common Web attack tactic, but most browser developers have made a point of eliminating such vulnerabilities.

Exploit modules for this vulnerability are now available for all versions of Metasploit.

The AOSP browser is no longer supported by Google, but is nevertheless "widely popular" and frequently re-installed by users who prefer it to other browsers, says Beardsley.

About the Author(s)

Sara Peters

Senior Editor

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad of other topics. She authored the 2009 CSI Computer Crime and Security Survey and founded the CSI Working Group on Web Security Research Law -- a collaborative project that investigated the dichotomy between laws regulating software vulnerability disclosure and those regulating Web vulnerability disclosure.


Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights