Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks

No ratings

Presented at NDSS 2014 by

Vitaly Shmatikov

Suman Jana

Martin Georgiev

Hybrid application frameworks introduce new browser APIs that let Web applications access native resources on mobile devices. We analyze inconsistencies between access control policies at different levels of the hybrid software stack, demonstrate how they expose native resources to malicious Web content, and propose a defense.