Crossing security domains [LWN.net]

Crossing security domains

Posted Jun 12, 2025 0:42 UTC (Thu) by wahern (subscriber, #37304)
In reply to: Crossing security domains by farnz
Parent article: Covert web-to-app tracking via localhost on Android

See this recent proposal: https://github.com/explainers-by-googlers/local-network-a...

to post comments

Crossing security domains

Posted Jun 12, 2025 8:50 UTC (Thu) by farnz (subscriber, #17727) [Link] (1 responses)

That proposal does, unfortunately, run into the "prompt for insecurity" problem, which means that it doesn't fully block the described exploit - not least because sites using the exploit could socially engineer their way to local network access.

It's a distinct improvement, however.

Crossing security domains

Posted Jun 12, 2025 10:12 UTC (Thu) by Funcan (guest, #44209) [Link]

Any prompt stops mass attacks of this because at least some of the people promoted will be technically skilled enough to be suspicious and follow up