Jyoti Prakash, Mikkel Baun Kjærgaard, Abhishek Tiwari · 2026 · arXiv (Cornell University)
DOI: 10.48550/arxiv.2610.27288 · cited by 0 works (OpenAlex) · open-access PDF
La interfaz de WebView en las aplicaciones híbridas de Android permite a la parte nativa (por ejemplo, Java) intercambiar datos con la Web (por ejemplo, JavaScript). Esto crea canales de flujo de información transversales que los analizadores de idioma único existentes no pueden analizar. Los análisis de aplicaciones híbridas existentes solo abordan parte del problema: algunos construyen gráficos de llamadas de puente, pero proporcionan análisis de flujo de información limitado, algunos dependen de suposiciones groseras, y algunos se centran sólo en vulnerabilidades web. Presentamos MifDroid, un marco de análisis dinámico estático-análisis guiado con un ciclo de vida consciente por llamadas de WebView, un sistema de análisis de tipo y efecto de puente consciente, y un análisis de motor JavaScript modular. Evaluamos MifDroid en 33
Machine translation (Meta M2M100); the English original follows.
The WebView interface in Android (hybrid) applications enables the native side (e.g., Java) to exchange data with the Web (e.g., JavaScript). This creates cross-language information flow channels that existing single-language analyzers cannot analyze. Existing hybrid app analyses address only part of the problem: some build bridge-aware call graphs but provide limited information-flow analysis, some rely on coarse assumptions, and some focus only on web vulnerabilities. We present MifDroid, a static-analysis- guided dynamic-analysis framework with a lifecycle-aware per-WebView call graph, a bridge-aware type-and-effect system, and a modular JavaScript analysis engine. We evaluated MifDroid on 338 apps from the F-Droid repository (out of 4,126 total) that use addJavascriptInterface, enabling active communication between Java and JavaScript. Our guided dynamic phase adds 662 entries to the 444 produced by static analysis, raising the resolution rate from 36.5% to 74.5%, produces the resolved bridge-related entries for 115 apps that static analysis leaves empty. MifDroid reported 14 vulnerable cross-language information flows, five of which have been accepted and fixed by the maintainers.
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
Topics: Computer science, Android (operating system), JavaScript, Java, Static analysis, Modular design
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.27288, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange