Definition of XSS

If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject a client-side script into a web site that is viewed by other people who become the victims of the attack.

An example of an XSS bug within Android O.S

Vulnerability Details

By sending a crafted intent to Chrome for Android, malicious Android apps can inject JavaScript: URIs into arbitrary Web pages loaded in Chrome. Injected JavaScript works in the context of the target Web page's domain, not a blank domain. So it can be used for Cookie theft or so. Such kind of vulnerabilities is often called Cross-Application Scripting.

Version

Chrome Version: Chrome for Android v18.0.1025123 Operating System: confirmed on Android 4.0.4 (Samsung Galaxy Nexus)

Reproduction Case

A sample code of a malicious Android app is attached.

Note

This issue was initially reported to [email protected] on Jul. 7 2012, but recently I heard from Google security team that the issue might not be filed in Chromium bug database. So now I re-submit the issue here which should be a legitimate place for reporting Chrome bugs.

My Question

Although I understand what Cross-Site-Scripting is and how Cross-Site-Scripting can take place. I don't know what factors makes a selection of Android code vulnerable to such an attack.

Definition of XSS

If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject a client-side script into a web site that is viewed by other people who become the victims of the attack.

An example of an XSS bug within Android O.S

Vulnerability Details

By sending a crafted intent to Chrome for Android, malicious Android apps can inject JavaScript: URIs into arbitrary Web pages loaded in Chrome. Injected JavaScript works in the context of the target Web page's domain, not a blank domain. So it can be used for Cookie theft or so. Such kind of vulnerabilities is often called Cross-Application Scripting.

Version

Chrome Version: Chrome for Android v18.0.1025123 Operating System: confirmed on Android 4.0.4 (Samsung Galaxy Nexus)

Reproduction Case

A sample code of a malicious Android app is attached.

Note

This issue was initially reported to [email protected] on Jul. 7 2012, but recently I heard from Google security team that the issue might not be filed in Chromium bug database. So now I re-submit the issue here which should be a legitimate place for reporting Chrome bugs.

My Question

Although I understand what Cross-Site-Scripting is and how Cross-Site-Scripting can take place. I don't know what factors makes a selection of Android code vulnerable to such an attack.