Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Note that this isn't an "incredibly serious system level issue." This is an issue with a browser that Google hasn't supported for several years, since they replaced it with Chrome. It also doesn't affect alternative browsers like Firefox or Opera.

Note that if Apple had a similar vulnerability, you likely couldn't work around it by using an alternative browser, because all browsers are required to use Safari's rendering engine.



My LG G2 (12 months old) shipped with an App called "Browser" and no Chrome.

Is this not the app you're talking about?

I would guess a great many Android users (if not the majority of Android users) are not using Chrome.

In fact, that's exactly the case according to this: http://www.netmarketshare.com

Chrome has made some strides this year, but the Android Browser still leads by a point. That'll probably change next month or two I'd guess. But unless I'm entirely off base and talking about the wrong thing, I think your comment is very misleading.

If this happened with Safari, you'd likely see a patch pretty quickly, and it would be available to almost everyone at the same time.


In addition to the Browser app that is still widely use in devices with less-than-latest Android versions, It's present in every app that uses WebView. And you only get fixes to WebView via OS updates. (x)

(x) Maybe. Assuming someone bothers to incorporate them into to the OS update for your device and they make it through the hurdles between the engineer and OTA update certification.


WebView uses Chrome as of 4.4 as well. Also many apps that use WebView show only their own content in it. There are only a couple apps that show user specified content in app via WebView, like Reddit and HN.

Even if I were to go back to the old Internet app instead of Chrome, this bug is irrelevant to me since I use an app for GMail, Twitter, Facebook and anything else important. I can't remember the last time I used the mobile browser for anything that matters.


It's still a copy of the browser code that comes with the base OS, even if it dodges the bullet on this bug. The Chromium-based WebView doesn't receive updates like the Chrome app so will generally contain unpatched vulnerabilities, so the system level issue remains.

(Note that the rare-to-nonexsistent OS updates are still a problem, this WebView issue nonwithstanding. They are running old vulnerable Linux kernels which compromises the app sandbox)


> The Chromium-based WebView doesn't receive updates like the Chrome app

We hope to see that change very soon. http://thenextweb.com/google/2013/11/12/google-says-working-...


Yes, I was referring to the WebView issue when I said "system level".


Android 4.4 and up use Chrome in their webviews, rather than the AOSP browser.


Think of it the way Apple abandoned Safari for Windows without letting the users know. They're still using Safari for Windows, it's just completely insecure and they have no idea.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: