One of Google’s Android security experts has explained why the company has stopped providing patches for some exploits in early versions of the software, and advised users of those versions to switch to the Chrome or Firefox web browsers on their devices.
News that Google had stopped providing patches for exploits in the WebView technology that rendered web pages on devices running versions up to and including Android 4.3 “Jelly Bean” emerged earlier in January.
The company’s new policy was to implement patches if they were provided by security researchers who’d discovered new security loopholes in the technology, or to pass their research on to device manufacturers for them to implement.
Adrian Ludwig, who works on Google’s Android security team, addressed the issue in a post on the company’s Google+ social network, explaining the challenges of providing security patches for older versions of WebView and the WebKit technology used for web browsing on Android.
“WebKit alone is over five million lines of code and hundreds of developers are adding thousands of new commits every month, so in some instances applying vulnerability patches to a two plus year old branch of WebKit required changes to significant portions of the code and was no longer practical to do safely,” wrote Ludwig.
“With the advances in Android 4.4, the number of users that are potentially affected by legacy WebKit security issues is shrinking every day as more and more people upgrade or get new devices.”
According to Google’s own stats, 60.9% of Android devices currently in use are running Jelly Bean or earlier versions of the software. That number may be shrinking, but it’s still the majority of Android users. If you’re one of them, Ludwig has some useful advice on how to ensure your web browsing remains secure:
“Using a browser that is updated through Google Play and using applications that follow security best practices by only loading content from trusted sources into WebView will help protect users.
When browsing on any platform, you should make sure to use a browser that provides its own content renderer and is regularly updated. For instance on Android, Chrome [http://goo.gl/elSkZX] or Firefox [http://goo.gl/Q5X6e3] are both great options since they are securely updated through Google Play often: Chrome is supported on Android 4.0 and greater, Firefox supports Android 2.3 and greater.”
It’s important advice, because Android users vary so much in their technical knowledge and upgrade habits. Less tech-savvy users who haven’t upgraded their smartphone for three or four years may require a nudge to switch web browsers.
Comments (…)
Sign in or create your Guardian account to join the discussion