Execution trace data from: Cross-boundary mobile tracking: exploring Java-to-JavaScript information diffusion in WebViews

WebViews are a prevalent method of embedding web-based content in Android
apps. While they offer functionality similar to that of browsers and
execute in an isolated context, apps can directly interfere with WebViews
by dynamically injecting JavaScript code at runtime. While prior work has
extensively analyzed apps' Java code, existing frameworks have
limited visibility of the JavaScript code being executed inside WebViews.
Consequently, there is limited understanding of the behaviors and
characteristics of the scripts executed within WebViews, and whether
privacy violations occur. To address this gap, we propose WebViewTracer, a
framework designed to dynamically analyze the execution of JavaScript code
within WebViews at runtime. Our system combines within-WebView JavaScript
execution traces with Java method-call information to also capture the
information exchange occurring between Java SDKs and web scripts. We
leverage WebViewTracer to perform the first large-scale, dynamic analysis
of privacy-violating behaviors inside WebViews, on a dataset of 10K
Android apps. We detect almost 4,600 apps that load WebViews, and find
that over 69% of them inject sensitive and tracking-related information
that is typically inaccessible to JavaScript code into WebViews. This
includes identifiers like the Advertising ID and Android build ID.
Crucially, 90% of those apps use web-based APIs to exfiltrate this
information to third-party servers. We also uncover concrete evidence of
common web fingerprinting techniques being used by JavaScript code inside
of WebViews, which can supplement their tracking information. We observe
that the dynamic properties of WebViews are being actively leveraged for
sensitive information diffusion across multiple actors in the mobile
tracking ecosystem, demonstrating the privacy risks posed by Android
WebViews. By shedding light on these ongoing privacy violations, our study
seeks to prompt additional scrutiny from platform stakeholders on the use
of embedded web technologies and highlights the need for additional
safeguard. This dataset contains the execution traces of all apps
successfully executed in our dataset.