According to MWR Labs, this issue occurs when the Google Admin app receives a URL via an IPC call from any other app on the same device. The Admin app will load that URL into a WebView within its own activity. If an attacker uses a file:// URL to redirect to a file they control, then it is possible to use symbolic links to bypass the Same Origin Policy and retrieve data from the Google Admin sandbox
The issue arises because the Google Admin app has an exported activity that accepts an additional string called setup_url. This can be triggered by any app on the device, creating a file with a URL that an attacker can write to via a string. ResetPinActivity will then load this into the WebView using the privileges of the Google Admin app.
This way, the attacker can add HTML to the available readable files and then delete those files and replace them with their own symbolic link with the same name that points to a file in the Google Admin sandbox. After a second, the iFrame in the WebView will load the file, which will now point to one of its own files. Because the parent and child frames have the same URL, the Same Origin Policy allows the parent frame to look up the content of the child frame. This means that the attacker-controlled HTML can read from the files loaded in the iFrame and extract their data.
No update has been released yet but it is recommended that devices with the Google Manager installed do not download apps from untrusted third‑party sources.
