Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews

Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews

Speakers: Sohom Datta

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=w3gZUHmatPM

Overview

This talk reveals a significant and largely undetected privacy abuse vector in the Android ecosystem: the exploitation of WebView boundaries to leak sensitive device information from Java/Kotlin app code into dynamically loaded JavaScript, which then exfiltrates it to third-party tracking servers. Researchers from NC State, University of Illinois Chicago, and Technical University of Crete built WebView Tracer, an open-source dynamic analysis system, and used it to analyze over 10,000 Google Play Store apps. Their findings are alarming -- 90% of apps that injected sensitive data into WebViews also leaked it to external servers, and popular games with over 100 million installs were among the worst offenders.

The research demonstrates that Google Play Protect's static scanning model is fundamentally blind to this attack because the malicious HTML/CSS/JavaScript is loaded dynamically at runtime, not bundled in the APK. This represents a web-shaped problem in the Android ecosystem that requires web-based dynamic analysis tools to detect.

Background

▶ Watch: How WebViews break the boundary between Java and JavaScript (0:30)

Android applications written in Java or Kotlin have access to low-level APIs that web code cannot reach -- precise GPS location, advertising IDs, device identifiers, and hardware information. WebViews are embedded browsers that allow apps to display web content as part of the app experience. A surprisingly large portion of what users see in mobile apps is actually rendered web content inside WebViews.

A critical design feature allows Java code to interact with JavaScript running inside WebViews through Java-to-JavaScript interface calls. This creates a bridge between the privileged app layer and the web layer, enabling app developers (or the third-party libraries they include) to pass sensitive device data into JavaScript code that can then send it to any server.

This attack was theorized over a decade ago in a 2014 NDSS paper by Son et al., "What Mobile Ads Know About Mobile Users." The current research is the first large-scale empirical investigation confirming that the abuse is happening at scale in the wild. Google Play Protect scans the Java code, third-party libraries, and embedded HTML/CSS/JavaScript within APKs, but it cannot inspect JavaScript that is dynamically fetched from remote servers after the app is installed and running.

Key Findings

▶ Watch: WebView Tracer architecture: orchestration, instrumentation, analysis (4:00)

45% of analyzed apps loaded WebViews, confirming that embedded web content is pervasive in the Android ecosystem.

60% of apps with WebViews injected sensitive data into the JavaScript execution context -- data that was never meant to reach web code.

90% of apps that injected data also leaked it to external servers, indicating systematic exfiltration rather than incidental data exposure.

Persistent identifiers including advertising IDs and precise location data were injected in approximately 18% of all loaded WebViews. Less identifying but still sensitive data like ADM Mob SDK version, device model, and build ID appeared in over 60% of WebViews.

Games are the worst offenders: Apps like War Robots Multiplayer Battles and Dumb Ways to Die -- both with over 100 million Play Store installs -- were found engaging in this behavior. Education apps injected comparatively less sensitive information, possibly due to privacy regulations protecting children (such as COPPA).

Google is the largest player in the abuse ecosystem: The Google Play SDK alone exfiltrated data to over 147 distinct companies during the one-month study period across four test phones.

25 tracking companies identified in the research have a tracking score of zero on DuckDuckGo Tracker Radar, meaning state-of-the-art tracking detection software does not flag them as trackers at all. The WebView context is sufficiently hidden that traditional web tracking detectors are blind to it.

A small number of third-party libraries -- including AppLovin, IronSource, InMobi, Unity3D, and Fyber -- were found to be highly clustered, all exfiltrating to the same set of companies, raising concerns about cross-app profile building using persistent identifiers.

Technical Deep Dive

▶ Watch: Key results: 90% of injecting apps leak to external servers (7:30)

WebView Tracer consists of three components:

Orchestration (UI Harvester): Uses the well-established UI Harvester tool to perform breadth-first search over the app's UI, clicking on each component to exercise app functionality and trigger WebView loading.

Instrumentation (Modified Visible V8): The core instrumentation is built on Visible V8, a tool that patches the V8 JavaScript engine to log all executed JavaScript. It operates at the V8 layer, making it extremely difficult to evade using standard JavaScript anti-analysis techniques. However, Visible V8 was originally a desktop tool -- the team spent over two years modifying it for Android WebViews. Key modifications included:

• Adding tracing for Java-to-JavaScript interface calls by hooking into the Blink engine (JavaScript-to-Java) and the return path (Java-to-V8)
• Fixing version drift issues where the logging flow was triggered far more frequently than intended, causing app crashes and freezes in the Android sandboxing environment
• Multiple performance optimizations to handle the constrained mobile execution environment

Analysis (Information Flow Engine): Creates taint flows between data sources (Java code, third-party libraries) and data sinks (third-party web servers). The entire ecosystem is visualized as a graph, enabling identification of which libraries leak to which companies.

The experimental setup involved downloading over 10,000 apps from the Google Play Store, running the analysis from February to March 2025, with all IPs labeled as coming from US academic institutions. The team also observed evasion behavior -- some apps changed their data injection patterns when run on emulators versus physical devices, and behavior varied based on geographic location (as discovered during artifact evaluation with VPN testing).

Apps that leak data through WebViews also showed higher fingerprinting API usage than non-leaking apps, suggesting that trackers are bridging web fingerprints with Android advertising IDs to create cross-domain user profiles.

Demo / Proof of Concept

▶ Watch: Google Play SDK leaks to 147 companies; 25 trackers invisible to detection (10:00)

The researchers did not perform a live demo but presented large-scale empirical results from their 10,000-app analysis. They showed visualization graphs of the exfiltration ecosystem, demonstrating the clustering of ad tech libraries like AppLovin, IronSource, InMobi, Unity3D, and Fyber around shared tracking destinations. Specific examples included War Robots and Dumb Ways to Die as high-profile apps with 100 million+ installs engaging in WebView-based data exfiltration.

Defensive Implications

▶ Watch: Q&A: evasion techniques and location-based behavior changes (14:00)

The most significant defensive finding is that Google Play Protect's current model is architecturally blind to this class of abuse. Since the malicious JavaScript is dynamically loaded from remote servers after app installation, no amount of APK scanning will detect it. The researchers recommend that Google adopt dynamic analysis tooling like Visible V8 or WebView Tracer to monitor runtime behavior of apps on the Play Store.

The discovery that 25 companies have zero tracking scores on DuckDuckGo Tracker Radar indicates that existing web tracking detection tools need to expand their coverage to include the WebView context. Browser-based tracking protection does not apply inside app WebViews, creating a significant blind spot.

The finding that app behavior changes based on execution environment (emulator vs. physical device, geographic location) suggests that evasion-aware dynamic analysis is necessary -- simple automated testing may not trigger the abusive behavior.

The changes to Visible V8 have been upstreamed to the main project, and the dataset has been publicly released, enabling the broader research and privacy enforcement communities to build on this work.

Key Takeaways

• 90% of Android apps that inject sensitive data into WebViews also leak it to external third-party servers
• Google Play Protect cannot detect this abuse because the tracking JavaScript is loaded dynamically at runtime, not bundled in the APK
• The Google Play SDK itself exfiltrated data to 147 distinct companies, making Google the largest player in the WebView tracking ecosystem
• 25 tracking companies identified in this research are invisible to DuckDuckGo Tracker Radar, indicating a blind spot in current tracking detection
• Games apps are the worst offenders, injecting advertising IDs and precise location data, while education apps inject less sensitive identifiers
• Ad tech libraries like AppLovin, IronSource, InMobi, Unity3D, and Fyber cluster together, leaking to the same companies and enabling cross-app profiling
• The modified Visible V8 changes have been upstreamed and the dataset is publicly available

About the Speaker(s)

Sohom Datta is the first author and presenter, affiliated with NC State University. He is a maintainer of the Visible V8 project and spent over two years adapting it for Android WebView analysis. The research was conducted in collaboration with colleagues including Mihalis, Assan, Juna, Anupam, Jason, and Dr. Kapravelos at NC State, University of Illinois Chicago, and Technical University of Crete.