Android Open Handset Developers Community

Hi all,
a couple of days after the market lunch of T-Mobile G1, security experts (not malicious guys) have found a serious vulnerability on the Android 1.0 web browser: the browser may be exploited by visiting a malicious page, so that an attacker can run arbitrary code with the same privileges of the web browser application. It seems that this vulnerability was found and fixed some time ago, but it is still in the Android code due to the fact Google did not use the most up to date versions of all the open source packages that are used in the current version of the platform.

We can console ourselves by knowing that the impact of this attack is somewhat limited thanks to the Android sandboxing mechanism of each applications with respect to the phone's enviroment. Apple's iPhone, for example, does not have this feature and all the phone's features can be accessed by means of a compromised application.

Hi all,
don't be too much worried: Google has already patched this security hole in the Android code: the patch has been also already released to G1 users by means of an OTA (over the air) software update the day after the official launch of the phone.

How-to check the software version currently used: Menu -> Settings -> About phone -> Build number.

First original G1 release: RC19 (security hole present)
Updated G1 release: RC28 (security hole fixed)

Best,
barban