Collected research

Automated Generation of Event-Oriented Exploits in Android Hybrid Apps

Guangliang Yang, Jeff Huang and Guofei Gu · ndss-symposium.org

Android hybrid apps let web content inside a WebView trigger event handlers written in native Java, and neither the same-origin policy nor Android permissions check where the event came from. EOEDroid vets apps with selective symbolic execution and auto-generates exploits, finding 97 flaws in 58 of 3,652 apps: cross-frame DOM manipulation, phishing, identifier leakage and Intent abuse.

Record

Researcher

Guangliang Yang, Jeff Huang and Guofei Gu

Published by

ndss-symposium.org

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2018 research round

Related sources

• NDSS2018 - Automated Generation of Event-Oriented Exploits in Android Hybrid Apps

Tags

• sop-bypass
• privilege-escalation
• info-leak
• dom
• android
• javascript
• static-analysis
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Guangliang Yang, Jeff Huang and Guofei Gu, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.