What actions can I take to make web browsing on mobile phone (android) as safe as possible? My main concern are sites that would install malware (has happened before on desktop computer). On a computer, I would run browser in a sandbox environment (e.g. Sandboxie). Are there similar alternatives for mobile phones? Or are mobile environments more completely sandboxed by nature?


Installing malware through websites is not as common as you seem to think. The malicious website needs to exploit a vulnerability in your browser which permits to get root access (quite uncommon).
So, as far as your browser is up to date, only the 0days (rare) could affect you.
But, even with less privilege, the malicious website could still tamper the behavior of your browser (spying you, insert scripts in the visited pages, ...).

Sandboxes can be a partial answer to this threat because they focus on isolating a process from the rest of the system (to avoid a malware spraying everywhere). They do are present in Android but they are not the ultimate protection.

Another way to protect you is to disable script (javascript mainly) in the setting of your browser.
But many websites will be broken as client side scripting is now a huge part of the Web 2.0.

Security experts, who want to keep their computer safe, rely on up to date Linux (android is Linux-based) and avoiding crap websites with malvertising (like porn, download, buzznews, ...).
It is less overkill than disabling the scripts.

Maybe take a look at the brave browser which is designed to limit the websites capabilities on your browser.

  • Sandboxes "focus on behavior"? Can you explain that? Sandboxes don't make decisions based on behaviour. They don't make decisions. They just contain. An up-to-date Windows box is also secure. I'm not sure that you can claim that security experts focus on Linux for security. Your list of malvertising sites is odd (what is "download" and "buzznews"?). – schroeder Aug 5 '20 at 11:04
  • As far as I know sandboxes launch the analyzed target in a controlled environment and they have a evaluation function to determine whether or not the security is degraded at the end. So it is technically not an evaluation of the behavior, it is just an analysis of the result, but I used this term to mark a contrast with the simple signature detection. – Sibwara Aug 5 '20 at 16:31
  • Concerning the fact that security experts rely on Linux for security, the main idea was about the packaging of the Web browser (updated with the system, so no surprise like in older windows with up to date system and outdated browsers) which is present in Android too. "Download" is about Warez, P2P, and other illegal share of cracked movies/games/programs. But also some websites which act as bank of program but ad some "bloatware"/spyware/... in the installer. Buzznews are websites that aggregate sensational news just to increase their traffic and sell ads – Sibwara Aug 5 '20 at 16:35
  • You are talking about a malware sandbox, not application sandboxing. The OP is talking about application snadboxing. – schroeder Aug 5 '20 at 16:36
  • Yes correct... my bad. I have to edit my answer – Sibwara Aug 5 '20 at 16:39

Android has a lot of security features like SELinux, permission system and sandboxing already to try to prevent exploits and malware.

But as with a lot of security, the user might be the weakest link. It is highly unlikely that a malicious website will take root access or even just exploit your browser without you noticing, but what is much more likely is some shady website downloading a malicious .apk on your phone and tricking you to execute it.

The solution to such attack is disabling installing third-party apps, which is already disabled by default. Also most browsers will warn you against downloading an .apk, so at this point getting infected by such malware would be like willingly jumping into a cage with tiger despite all warnings.

The bigger issue to Android security can be apps from Google Play, which not always are closely inspected and examined and can contain malicious code, so you should only ever install programs that you trust.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.