Google has a secret browser hidden inside the settings (matan-h.com)

Article summary

A secret browser has been discovered within the Google Settings app on Android devices, accessible through a series of steps. This browser allows users to visit any website, bypassing parental controls, and has some unique features such as no history and auto-logout. The browser also has some potentially dangerous functions, including JavaScript objects that could be used to set local encryption keys. The discovery of this browser has sparked discussion about its implications for security and parental controls.

Main themes

• secret browser
• Android security
• parental controls
• embedded webviews
• privacy features
• security vulnerabilities

What commenters say

• The secret browser's ability to bypass parental controls is a significant security issue.
• The browser's exposed API for password manager key management and recovery is a potential vulnerability.
• Embedded webviews are commonly used in apps and can often be used to bypass parental controls.
• The lack of address bar and history in the secret browser could be seen as a privacy feature.
• Normal embedded webviews do not typically expose privileged JS functions or bypass parental controls.
• The secret browser is likely an instance of Android System Webview, which can be used by apps to display web content.
• Limiting the webview browser location to a specific list of allowed domains could help enforce sandbox and parental controls.
• The existence of this secret browser highlights the need for better security and parental control measures in Android apps.