Hacker News Reader

Comment by yeahforbes | Hacker News Reader

I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)

View on HN

Almost all third-party browsers on the Play Store wrap the Android WebView, which is vulnerable. You'll need to use a browser that includes its own rendering engine, such as Firefox, to remain secure.

The Android WebView uses since quite some time the same rendering and javascript engines as Chrome. Thus I would expect third party browsers to be no more vulnerable with regard to this bug than Chrome.

Edit: since 4.4 [https://developer.chrome.com/multidevice/webview/overview]

Hi YeahForbes,

TomPod, the creators of InBrowser, here.

We're unable to reproduce this error on a oneplus and a HTC M8 running the latest version of InBrowser. But rest assured, we'll check this with our suite of devices and Android version during the day.

Since version 2.11 (43), 2014-03-09 we limit the usage of JavaScript: due to another bug in Android. Hopefully it'll fix this issue as well. So please make sure that you're on latest version from Google Play.

If we can fix this on our side we'll push a fix asap. If not, we unfortunately need to wait for Google to address this. We'll post any updates on this issue at @tompodapps.

Thanks for reporting it!

Reply on news.ycombinator.com