Last month, Google took the bold steps to release the details of a security vulnerability ahead of Microsoft"s Patch Tuesday. Microsoft said that the patch was set to be released two days after Google went live with the details and that they refused to wait an extra 48 hours so that the patch would have been released along with the details of the exploit.
Recently, an exploit has been uncovered in Android 4.3 (Jelly Bean) - which covers roughly 60% of Android"s install base, according to the Android Developer dashboard - and Google is saying that they will not patch the flaw.
In response to Tod Beardsley"s questioning Google over the flaw and if they would patch it, the Android security team responded by saying:
If the affected version [of WebView] is before 4.4, we generally do not develop the patches ourselves, but welcome patches with the report for consideration. Other than notifying OEMs, we will not be able to take action on any report that is affecting versions before 4.4 that are not accompanied with a patch.
The flaw, which exists in WebView (a core component used to render web pages on an Android device) impacts nearly 1 billion users, when using Google"s own numbers as a base along with Gartner figures. Industry reports say that there are roughly 1.56 billion phones with Android on them, and if 60% are running the now non-supported version of Android, that means roughly 930 million phones are now vulnerable.
Jelly Bean was first announced in June of 2012, which means that Google is dropping support for its mobile OS less than three years after it was released.
This present a large issue for those who want to use Android phones in the corporate world as Google is clearly stating that legacy support for the OS is not on their agenda. The fact that phones are still being sold with Jelly Bean means that the vulnerability is not going away anytime soon, as devices with the OS will be in consumers" hands for many years to come.
Source: Tod Beardsley of Rapid7