Roughly 939 million Android phones affected by a grave bug, Google won't do anything about it

According to Tod Beardsly, a security analyst with Rapid7, all Android version below Android 4.4 KitKat are suffering from a pretty serious security vulnerability, which leaves them out on a limb, susceptible to malicious hacker attacks.

It seems that the culprit for this security hole is a bug found inside Android WebView, an undividable part of Android 4.3 and lower builds, which allows you to display online content in a given app. It's works alongside numerous other core Android services, which, naturally, leaves a security breach as wide as the Grand Canyon.

This security flaw leaves roughly 939 million Android handsets vulnerable to malicious attacks, which is a pretty serious figure. Generally, one might speculate that Google will be addressing the flaw as we speak, working on an urgent hotfix. However, one would be quite wrong, unfortunately.

It seems that Mountain View is not concerned at all about the WebView security issue, declining to fix the problem, and leaving the various OEMs to cope with it themselves. Considering the fragmentation of the platform, this generally means that a lot of these might not address the issue, too.


Google uses another similar component for Android 4.4.x KitKat and 5.0 Lollipop, which means that they can't be affected by the WebView bug. Yet, these versions of the OS are not as widely-present as the older ones.

It looks like Tim Cook might have been entirely correct when he claimed that Android is a "toxic hellstew of vulnerabilities". Any thoughts?

source: BGR