Collected research

Automatically Detecting SSL Error-Handling Vulnerabilities in Hybrid Mobile Web Apps

Chaoshun Zuo, Jianliang Wu and Shanqing Guo · lilicoding.github.io

Hybrid Android apps show web content in a WebView and frequently override the SSL error handler to call proceed, so the app keeps loading an HTTPS page whose certificate failed validation and can be intercepted. A combined static and dynamic analysis finds this automatically, confirming 645 vulnerable apps among 13,820 scanned.

Record

Researcher

Chaoshun Zuo, Jianliang Wu and Shanqing Guo

Published by

lilicoding.github.io

Format

Whitepaper

Topic

Crypto

In the archive

• Collected in the 2015 research round

Tags

• tls
• https
• android
• static-analysis
• dynamic-analysis
• large-scale-scan
• detection
• owasp-a02-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Chaoshun Zuo, Jianliang Wu and Shanqing Guo, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.