I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier.

I haven't heard of any serious or common problems that concern only mobile browsers.

Please answer if you know one.

  • Actually, your question is confusing. Could you please clarify what are "web-application used on mobile phones"? Otherwise this question has no sense.
    – anonymous
    Commented Nov 14, 2010 at 1:07
  • @Ams, @naugtur means Are there any attacks/etc via webapps that attack specifically browser clients on mobile phones, and not full desktop versions of browsers.
    – AviD
    Commented Nov 14, 2010 at 2:02
  • I seem to remember talk about a bluetooth-targeting attack a year or three ago, but since I don't remember any details I'm not putting this as an answer.
    – AviD
    Commented Nov 14, 2010 at 2:03
  • @AviD Thanks! That's a great clarification there ;)
    – naugtur
    Commented Nov 15, 2010 at 9:56

4 Answers 4


Yes. Mobile browsers are generally at greater security risk than full-sized desktop browsers, for a number of reasons. Here are some examples:

  • Tap-jacking. Tap-jacking is more powerful on modern phone browsers (compared to full-size desktop browsers): see this paper.

  • Phishing and UI spoofing. Mobile phone browsers don't reserve screen real estate for the "browser chrome" and its corresponding security indicators: e.g., the address bar, padlock icons or signs of HTTP/HTTPS/EV-HTTPS, etc. In particular, web pages can go fullscreen and scroll away the browser chrome, leaving no browser chrome. Once the web page has done so, a malicious web page could draw a spoofed address bar. In one user study, almost every single user was fooled by a phishing attack of this sort. This may pose increased risk: e.g., to phishing, clickjacking, and other social-engineering or human-factors related attacks on the user.

  • Vulnerable mobile web sites. Many websites offer separate sites specifically for mobile clients. Those mobile-optimized versions of the site often have vulnerabilities not present in the normal site; see, e.g., this paper for some examples of this (relating to clickjacking).

  • Webview-related vulnerabilities. Many mobile applications use webviews, to seamlessly embed a web page into the application. However, at least on Android, if webviews are not used carefully, they can introduce vulnerabilities that allow a malicious website to misuse the application's access to the user's phone and information. This risk is specific to mobile systems.

  • this UI spoofing is something totally new for me. Good findings!
    – naugtur
    Commented Apr 6, 2012 at 18:13

Those vulnerabilities should be targeting the navigation system of the mobile devices.

Unfortunately I don't have an example on that but this example seems as if even the iPhone has a XSRF-like issue. Web pages can start apps and trigger actions in the apps: http://www.dhanjani.com/blog/2010/11/insecure-handling-of-url-schemes-in-apples-ios.html


Here is an example from: http://threatpost.com/en_us/blogs/researcher-publishes-android-browser-exploit-110810

"Researcher MJ Keith published a Reverse Shell Exploit that affects mobile devices running Android's 2.0 and 2.1 operating system on November 5. The shell code takes advantage of a known vulnerability affecting WebKit, a common component of Web browsers, including the one bundled with Android, that is used to render Web page content and manage Web browsing sessions. The hole could be triggered by visiting a malicious Web site, according to a description of the hole published by Mitre."

Update 01/26/11:

This was posted on the Dailydave's newsgroup on 01/26/11:

You've probably already figured out that this bug is in Webkit. Our research team is currently checking out what is and is not vulnerable. The initial results are this: we've got an exploit in development for Android. The iPhone should be vulnerable, we're still researching that. Chrome is a bit early to call, we're still testing there. The sound bite here is this: anything that depends on Webkit should be checked out.

Re-cap: Yes there are vulnerabilities that can affect only mobile solutions.

  • 2
    Nice, but that sounds as if it would apply to non-mobile webbrowsers too, as long as they use webkit. The OP was looking for attacks that apply only to mobile.
    – AviD
    Commented Nov 14, 2010 at 12:33
  • It may, but there are 20+ different webkits and apparently each phone vendor has their own webkit fork, so it is reasonable to suggest vulnerabilities may exist only for a particular version. Commented Nov 14, 2010 at 18:00

Do mobile browsers have any special file/protocol handlers such as dialer or SMS?

  • @atdre, unless its an actual answer, this should be a comment, perhaps under the OP. Or, was this a cynical way of saying "Does a bear p**p in the woods?"
    – AviD
    Commented Nov 14, 2010 at 23:44
  • 1
    @Avid: Both of your conclusions are correct
    – atdre
    Commented Nov 15, 2010 at 1:41
  • 1
    Heh, @atdre take into account that many users here will not pick up on your humour. I am starting to catch it often though.... :D
    – AviD
    Commented Nov 15, 2010 at 7:14
  • 1
    Also, do you have exmples / know of specific attack vectors to exploit these handlers? I would think they are (should be) insulated from the browser....
    – AviD
    Commented Nov 15, 2010 at 7:15
  • 1
    Witty, but lacking content ;) It sure is subjective, but I prefer answers like "Oh, look! I spotted one there yesterday". Anyway - I get the point.
    – naugtur
    Commented Nov 15, 2010 at 10:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .