I'd like to know how dangerous Javascript can be for Android devices.

I know that there's the NoScript AddOn for the Firefox mobile browser but that's not really an effective solution as it's very inconvenient (it's inconvenient enough on Desktop Firefox).

Are there known cases of Android infections via Javascript? What could theoretically be done to these millions (or is it billions already?) of devices via this way and what are the technical theoretical, researched and implemented protection-measures against these?

closed as too broad by ThoriumBR, Xander, Steve, Bacon Brad, Tobi Nary Sep 15 '17 at 10:39

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Well this is the latest one related to javascript, an estimated 36.5 million Android devices may have been infected. https://www.theregister.co.uk/2017/05/30/android_app_judy_malware/

Read this as well by Siegfried Rasthofer


You can also see my this answer although it is about java virtual machine(dalvik) not javascript, but attackers can chain browser javascript based exploits with Dalvik or Linux Kernel exploits to gain elevated privilages, remote code execution, etc.

What kind of attack vectors are made possible as a result of Java being hopelessly intertwined with Android?

You can also google "Android Javascript CVEs" to see more examples.

  • These exploits run outside of the sand boxed environment of the browser. web apps and web views typically have way more privileges than say browsing a regular website. – Bacon Brad Sep 14 '17 at 21:03

How dangerous Javascript can be on Android? I think Vladimir pretty much summed it up in his answer quite well. As for NoScript it maybe inconvenient but it works when used correctly, it does affect the browsing experience, as many sites tend to either break completely or do not work properly without javascript. Addressing the last part of your question "what are the technical theoretical, researched and implemented protection-measures against these?"

NoScript is the easiest to implement, Now in Android, each App is sandboxed, and has a seperate UID (user) and apps cannot read or write each others data. Now if you keep your phone updated with the latest security patches and do not sideload APKs from unknown sources, and do not visit shady websites, the risk from javascript is minimal. If you want a better solution that does not affect your browsing experience then you can use security hardened ROMs like cryptogenmod ROM, CopperheadOS, or if you are really paranoid like I am you can use a seperate phone for browsing. Thats what I have been doing for the past 6 years, I keep a seperate phone that runs a customized hardened ROM that I use for sensitive things like online payments or anything banking related.

Hope I have answered your question.

Not the answer you're looking for? Browse other questions tagged or ask your own question.