DEFCONConference: DEF CON SG1 - CSIT Village - Kang Hao - Android Security Javascript Bridge Is Falling Down

An insecure JavaScript bridge (JSB) in Android WebView allows attackers to abuse exposed interfaces to read local files and steal session cookies, leading to full account takeover via malicious deep links and JavaScript injected into the Android WebView context. During this session, we will dive into the details.