Bypassing Browser Security Policies for Fun and Profit

Explore a comprehensive analysis of mobile browser security vulnerabilities in this Black Hat conference talk. Delve into the world of bypassing core security policies like Same Origin Policy and Content Security Policy in mobile browsers. Discover various security flaws including Address Bar Spoofing, Content Spoofing, Cross Origin CSS Attacks, Charset Inheritance, CSP Bypass, and Mixed Content Bypass found in Android browsers. Learn about the testing methodology used to uncover Android zero-day vulnerabilities and examine real-world examples of security weaknesses in popular Android third-party web browsers and Android WebView. Gain insights into the root causes of these bugs, their exploitation techniques, and potential patches. Conclude with a demonstration of a sample test suite for assessing basic security properties of mobile web browsers.