No Patch to Same Origin Policy (SOP) Bypass in Old Android Devices

The report explains that Google will not produce security updates for Android versions older than 4.4, while Rapid7 and other researchers have demonstrated a WebView Same Origin Policy bypass affecting Android 4.0–4.3 and earlier. This vulnerability can be exploited via MITM or phishing to access content from sites a user is logged into (potentially defeating SSL at the client), placing hundreds of millions of users and enterprises with BYOD programs at risk; the article urges enterprises to mitigate exposure and promotes Zimperium’s mobile threat defense.