Two New Attack Vectors to Aggravate the Android addJavascriptInterface RCE Issue (CVE-2014-7224)

The Android addJavascriptInterface Remote Code Execution (RCE) issue is a disaster in Android ecosystem (see background knowledge here and here). CVE had assigned CVE-2012-6636 for the basic issue, and CVE-2013-4710 for attack vectors introduced in some devices, and CVE-2014-1939 for the default searchBoxJavaBridge_ vector in specific Android versions. For the defense side, developers are recommended to not invoke the addJavascriptInterface API, and meantime call removeJavascriptInterface("searchBoxJavaBridge_") to avoid the by-default impact.

Today we identify two new attack vectors, "accessibility" and "accessibilityTraversal", by default introduced by android/webkit/AccessibilityInjector.java.

more here..........https://daoyuan14.github.io/news/newattackvector.html