Jyoti Prakash, Mikkel Baun Kjærgaard, Abhishek Tiwari · 2026 · arXiv (Cornell University)
DOI: 10.48550/arxiv.2610.27288 · cited by 0 works (OpenAlex) · open-access PDF
안드로이드(하이브리드) 애플리케이션의 WebView 고정 인터페이스는 네이티브 측면(예: Java)이 웹과 데이터를 교환할 수 있도록 해줍니다(예: JavaScript). 이로 인해 기존 단일 언어 분석가가 분석할 수 없는 교차 언어 정보 흐름 채널이 생성됩니다. 기존 하이브리드 애플리케이션 분석은 문제의 일부만 해결합니다: 일부는 브릿지 알림 호출 그래프를 구축하지만 정보 흐름 분석을 제한하고, 일부는 거친 가정에 의존하며 일부는 웹 취약점에만 초점을 맞추고 있습니다. 우리는 MifDroid을 소개합니다. MifDroid는 정적 분석 지시된 역동적 분석 프레임워크로 웹View 호출 당 수명주기 인식 그래프
Machine translation (Meta M2M100); the English original follows.
The WebView interface in Android (hybrid) applications enables the native side (e.g., Java) to exchange data with the Web (e.g., JavaScript). This creates cross-language information flow channels that existing single-language analyzers cannot analyze. Existing hybrid app analyses address only part of the problem: some build bridge-aware call graphs but provide limited information-flow analysis, some rely on coarse assumptions, and some focus only on web vulnerabilities. We present MifDroid, a static-analysis- guided dynamic-analysis framework with a lifecycle-aware per-WebView call graph, a bridge-aware type-and-effect system, and a modular JavaScript analysis engine. We evaluated MifDroid on 338 apps from the F-Droid repository (out of 4,126 total) that use addJavascriptInterface, enabling active communication between Java and JavaScript. Our guided dynamic phase adds 662 entries to the 444 produced by static analysis, raising the resolution rate from 36.5% to 74.5%, produces the resolved bridge-related entries for 115 apps that static analysis leaves empty. MifDroid reported 14 vulnerable cross-language information flows, five of which have been accepted and fixed by the maintainers.
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
Topics: Computer science, Android (operating system), JavaScript, Java, Static analysis, Modular design
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.27288, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange