Any security issues reported for WebView, Android , and versions prior to KitKat (4.4), are no longer a priority for the software security team.
Currently, 60.9%, or nearly a billion users of the software, still rely on JellyBean (4.3) and versions even older than that.
WebView is an important system in the operating system. It was developed by Google, and renders web pages on the device screen. Since KitKat, it has been replaced with a newer version based on Chromium.
After contacting the developer who also deals with Android security incidents, researchers at Rapid7 found that Google has stopped making patches for issues related to versions lower than 4.4 WebView.
In addition to the fact that more than 930 million users have a version on their phone that will no longer receive official support from Google, Rapid7's Tod Beardsley says that WebView vulnerabilities are discovered quite frequently, and 11 have already been submitted to Metasploit for the necessary testing.
Beardsley says the reasoning behind this decision is that Google no longer certifies third-party devices, even if they have this software installed.
The most serious problem is that more than half of the users of these devices are now at risk, unless they upgrade or change their device. In some cases, the risk will be permanent since there is no one willing to release patches for these security problems, even outside of Google.
