Dangerous Android exploit could turn over complete control of an Android handset to a hacker
![Dangerous Android exploit could turn over complete control of an Android handset to a hacker](https://m-cdn.phonearena.com/images/article/75758-wide-two_350/Dangerous-Android-exploit-could-turn-over-complete-control-of-an-Android-handset-to-a-hacker.jpg?1447436957)
A new exploit discovered in the latest Chrome for Android app, is a threat to all Android handsets. There is much at stake since the exploit can allow a hacker to grab total control of an Android device away from its owner. A security researcher revealed the exploit at the PacSec conference in Tokyo. A flaw in JavaScript v8 is believed to be at the center of this issue.
Unlike other exploits that require multiple vulnerabilities to execute, this new security issue can be unleashed in "one shot." In addition, all Android handsets are threatened, even those running the latest version of Google's open source OS. A hacker could, in theory, get an Android user to open a malicious website on his/her handset, which would eventually allow the hacker to control all aspects of the phone. Obviously, this would allow the hacker to learn all of the private information that the phone owner has stored on his/her device. That could include account numbers, passwords, and other financial information.
At the conference, the bug was demonstrated to those in attendance on a Nexus 6 running on Google's Project Fi hybrid MVNO service. A Google security expert was at the conference and received the exploit. Since the exploit isn't out in the public, and Google knows about it, we should see a security patch sent out via an OTA update in the not too distant future.
The bug was discovered by Quihoo 360 researcher Guang Gong, who presented it at PacSec. It took him three months to develop the exploit.
source: TheRegister via SlashGear
"As soon as the phone accessed the website the JavaScript v8 vulnerability in Chrome was used to install an arbitrary application (in this case a BMX Bike game) without any user interaction to demonstrate complete control of the phone. The vuln being in recent version of Chrome should work on all Android phones; we were checking his exploit specifically but you could recode it for any Android target since he was hitting the JavaScript engine"-Dragos Ruiu, PacSec organizer
The bug was discovered by Quihoo 360 researcher Guang Gong, who presented it at PacSec. It took him three months to develop the exploit.
source: TheRegister via SlashGear
Things that are NOT allowed: