Google Chrome Vulnerability Could Have Let Hackers Steal Your Confidential Data
Links in an Android Apps Could Have Led to a Malicious Payloads!
The security researchers have recently discovered a serious vulnerability in Google Chrome web browser, which could be easily used to steal your personal details.
The Positive Technologies researcher Sergey Toshin, who uncovered the bug last December and disclosed it to Google in January, which patched the bug a few weeks later.
READ: Flickr Photos are Anonymously Used by IBM for Facial Recognition Training
There is no evidence that it was actively exploited, but given the broad reach of the vulnerability, it’s now difficult to be sure of it.
The bug was disclosed in Google patch notes from January, which was described as a high security vulnerability with “insufficient policy enforcement.”
After another report from Positive Technologies Researchers says, that now we know that the bug affected Android’s WebView component, which was commonly used to display pages inside the Android apps.
In fact, the vulnerability is existed in the Google’s Chromium engine, and it was present in all version of Android 4.4 and up.
“MALICIOUS PAYLOAD”
The attackers could easily have exploited the vulnerability by linking the users to a malicious instant apps, which will than run a small file that has the access to a phone’s hardware.
From there, the hackers could intercept user data. “After an update containing a malicious payload, such applications could read information from WebView. This enables access to browser history, authentication tokens commonly used for login in mobile apps, and other important data,” said Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies.
READ: Nulled Themes Used By Many Users are Full of High Risk of Vulnerability
Any users, who is running Android 7.0 and up should have updated their Google Chrome browser back in January, while the users running earlier version of the Android had to update WebView through Google Play Store.
Android users who don’t have their Google Play will have to wait for an update from a device manufacturer.
