How Android Apps Leak Device Identifiers Across the Native–Web Boundary
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Researchers built WebViewTracer to show that Android SDKs push device identifiers such as the Advertising ID into WebView JavaScript, where third-party scripts forward them to external servers. In a study of 10,000 Google Play apps, 65% of WebView-using apps injected context-restricted data, mostly through bundled third-party libraries.