Zero-Day Vulnerabilities In Dolphin And Mercury Browsers For Android

In the Dolpin and Mercury Browsers for Android are vulnerabilities that an attacker could execute arbitrary code on the system or the files can read the browser and for which no update for developers is available.Reported researcher "rotlogix".

Dolphin Browser is installed between 50 million and 100 million times and claims to be the best Android browser. To attack the vulnerability, an attacker must be between the Internet and the user, for example in a wireless network. Then, the attacker must wait until the user downloads a new Dolphin Browser-theme and install. Through themes users can customize the appearance of the browser.

The download takes place over HTTP, allowing an attacker to offer a customized theme. The evil theme then let the attacker run arbitrary code in the context of the browser. The developers of the Dolphin Browser have been notified, but an update is not yet available. Pending the update, users download the advice not new themes in a network environment that they do not manage. Another possibility is to use temporarily a different browser.

Mercury Browser

Another browser for Android where the investigator found problems in the Mercury Browser. This browser has been downloaded between 50,000 and 100,000 times. Through various vulnerabilities in the browser, an attacker can read files in the data directory of the browser and customize it. To carry out the attack, the user must open a specially prepared HTML file. Also in this case, there is still no solution is available. Users also are advised to remove the browser from their device and use an alternative.

Google Play Leak Makes Possible Automatic Install Apps

A vulnerability in the Google Play Store allows attackers to install apps from automatically from the store on the devices of Android users. The problem is caused by the Google Play support domain no X-Frame-Options (XFO).

A malicious user could then through Cross-Site Scripting (XSS) in a particular part of the Google Play web application, or via Universal XSS (UXSS) remotely install any app from Google Play and start. According to Todd Beardsley security company Rapid7 are many versions of Android 4.3 (Jelly Bean) and previously supplied with browsers that are vulnerable to UXSS.

In addition, there is the possibility that users themselves have installed a vulnerable browsers. Users who want to protect themselves against the problem have therefore advised to use a browser which does not occur frequently UXSS vulnerabilities, such as Google Chrome, Mozilla Firefox or Dolphin Browser. Another solution is not to be logged into a Google account while surfing.

The problem was reported to Google on December 12 last year. However, no mention is made of the vulnerability is fixed.Rapid7 did create a module for Metasploit to demonstrate the vulnerability. Metasploit is a framework for testing the safety of the systems. The now published module combines two vulnerabilities to execute arbitrary code on Android Devices.

First create the module using a UXSS leak in the default Android browser, as well as various other browsers on Android 4.3 and above. In addition, maintains the Google Play web interface no X-Frame-Options and is therefore vulnerable to script injection. The end result is the remote execution of code from Google Play's feature to remotely install apps. An attacker can therefore install and start anywhere in the Play store.