  Many Android applications embed webpages via WebView components and execute
JavaScript code within Android. Hybrid applications leverage dedicated APIs to
load a resource and render it in a WebView. Furthermore, Android objects can be
shared with the JavaScript world. However, bridging the interfaces of the
Android and JavaScript world might also incur severe security threats:
Potentially untrusted webpages and their JavaScript might interfere with the
Android environment and its access to native features. No general analysis is
currently available to assess the implications of such hybrid apps bridging the
two worlds. To understand the semantics and effects of hybrid apps, we perform
a large-scale study on the usage of the hybridization APIs in the wild. We
analyze and categorize the parameters to hybridization APIs for 7,500 randomly
selected and the 196 most popular applications from the Google Playstore as
well as 1000 malware samples. Our results advance the general understanding of
hybrid applications, as well as implications for potential program analyses,
and the current security situation: We discovered thousands of flows of
sensitive data from Android to JavaScript, the vast majority of which could
flow to potentially untrustworthy code. Our analysis identified numerous web
pages embedding vulnerabilities, which we exemplarily exploited. Additionally,
we discovered a multitude of applications in which potentially untrusted
JavaScript code may interfere with (trusted) Android objects, both in benign
and malign applications.
