The Inside Story: There are Apps in Apps and Here is How to Break Them
summary
Compares two instant app architectures: WebView-based instant apps that run page logic in a single service worker per domain and use a JS bridge, and native google play instant bundles that run isolated processes under a supervisor. Shows concrete bugs: a flawed webview id keymap where an fld parameter enables lateral movement, an xrpc path that lets the supervisor call arbitrary backend APIs, webpack packaging blacklists/localization bypasses to use importScripts in service worker, and an intentSender overwrite and duplicate provider authority that escape the native sandbox.
AI-written summary · about
chapters (4)
- 0:00Start
- 3:57Architecture of Wbaa
- 9:04The Back-End Render Server
- 18:28How Ipc Proxy Works about Access Control
related talks
42mInstant Apps
40mInstant Apps Eulogy
49mInstant Apps: How to Teach an App to Work Without Installation
38mInside Instant Apps
44mANDROID INSTANT APPS: How We Taught an App to Work Without Installation
23mA pragmatic approach to WebViews
39mApps: Modular, Instant, Dynamic
34mOvercoming JavaScript Unsecurities in WebViews