Google stops patching WebView exploits in older Android software | Technology | The Guardian
Move shifts responsibility to smartphone and tablet makers for vulnerabilities in devices running versions up to Android Jelly Bean

The security of smartphones and tablets running Android is under scrutiny again, after it emerged that Google is no longer providing patches for some exploits in early versions of the software.

The latest debate focuses on exploits found by researchers in the WebView technology that renders web pages on smartphones and tablets running versions up to and including Android 4.3 “Jelly Bean”.

The Metasploit blog revealed the change in policy
, based on exploits submitted to Google by security researchers Rafay Baloch and Joe Vennix, who have been prodding at Android software looking for vulnerabilities.

It quotes feedback from Google’s Android security team on exploits in the WebView component, which was replaced in 2013 when the company launched Android 4.4 “KitKat”.

“If the affected version is before 4.4, we generally do not develop the patches ourselves, but welcome patches with the report for consideration,” explained an email from the security team, published by Metasploit.

“Other than notifying OEMs, we will not be able to take action on any report that is affecting versions before 4.4 that are not accompanied with a patch.”
The onus is on researchers to supply their own patches, or for OEMs – smartphone and tablet manufacturers – to patch the exploits and push new software to owners of their devices.

Why is this controversial? Because a lot of Android devices being used in 2015 are still running older versions of the software, according to Google’s developer dashboard. 60.9% of them, in fact.

Breaking that down: 46% are running Jelly Bean; 6.7% its predecessor Ice Cream Sandwich; 7.8% the version before that, Gingerbread; and 0.4% are running Android 2.2 Froyo, which was released in 2010.

Metasploit suggested that if security researchers continue to look for vulnerabilities in older Android software and publish details of their findings, cybercriminals could take advantage.

“Open source security researchers routinely publish vulnerability details and working exploits with the expectation that this kind of public discussion and disclosure can get both vendors and users to take notice of techniques employed by bad guys,” explained the site.

“By ‘burning’ these vulnerabilities, users come to expect that vendors will step up and provide reasonable defenses. Unfortunately, when the upstream vendor is unwilling to patch, even in the face of public disclosure, regular users remain permanently vulnerable.”

is still providing security patches for other elements of Android software, including versions before KitKat.

But the policy for exploits of those older versions’ WebView component risks leaving owners of old devices with a stark choice: update the software (if that’s possible), buy a new device, or risk being less secure.

With Google announcing in June 2014 that there were more than one billion active Android users, there could be upwards of 600 million people facing that choice – if they’re even aware that the issue exists.