Newest papers

A Hybrid Information Flow Analysis Framework for Android Hybrid Apps

Jyoti Prakash, Mikkel Baun Kjærgaard, Abhishek Tiwari · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27288 · cited by 0 works (OpenAlex) · open-access PDF

French

L'interface fixe WebView dans les applications Android (hybrides) permet à la partie native (par exemple, Java) d'échanger des données avec le Web (par exemple, JavaScript). Cela crée des canaux de flux d'information transversaux que les analystes monolingues existants ne peuvent pas analyser. Les analyses d'applications hybrides existantes ne traitent qu'une partie du problème: certains construisent des graphiques d'appel au pont, mais fournissent une analyse de flux d'information limitée, certains s'appuient sur des hypothèses grossières, et certains se concentrent uniquement sur des vulnérabilités web. Nous présentons MifDroid, un cadre d'analyse dynamique guidée par analyse statique avec un graphique de communication actif au cycle

Machine translation (Meta M2M100); the English original follows.

Abstract

The WebView interface in Android (hybrid) applications enables the native side (e.g., Java) to exchange data with the Web (e.g., JavaScript). This creates cross-language information flow channels that existing single-language analyzers cannot analyze. Existing hybrid app analyses address only part of the problem: some build bridge-aware call graphs but provide limited information-flow analysis, some rely on coarse assumptions, and some focus only on web vulnerabilities. We present MifDroid, a static-analysis- guided dynamic-analysis framework with a lifecycle-aware per-WebView call graph, a bridge-aware type-and-effect system, and a modular JavaScript analysis engine. We evaluated MifDroid on 338 apps from the F-Droid repository (out of 4,126 total) that use addJavascriptInterface, enabling active communication between Java and JavaScript. Our guided dynamic phase adds 662 entries to the 444 produced by static analysis, raising the resolution rate from 36.5% to 74.5%, produces the resolved bridge-related entries for 115 apps that static analysis leaves empty. MifDroid reported 14 vulnerable cross-language information flows, five of which have been accepted and fixed by the maintainers.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Android (operating system), JavaScript, Java, Static analysis, Modular design

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange