Dolphin Browser for Android
Arbitrary File Write
CVE ID
Vendor
Mobotap
Product
Dolphin Browser for Android
Product Version
< 12.0.2
Vulnerability Details
The Backup and Restore feature in Mobotap’s Dolphin Browser for Android 12.0.2, suffers from an arbitrary file write vulnerability when attempting to restore browser settings from a malicious Dolphin Browser backup file. This arbitrary file write vulnerability, allows an attacker to overwrite a specific executable in the Dolphin Browser’s data directory with a crafted malicious executable. Every time the Dolphin Browser is launched, it will attempt to run the malicious executable from disk, thus executing the attacker’s code.
Vendor Response
Mobotap has not issued a reponse nor an update to remediate this vulnerability.
Disclosure Timeline
-
Reached out on Twitter and asked to speak with someone who is responsible for product security
-
Emailed requesting to speak with someone who can address security issues in the Dolphin Browser for Android, no response
-
Emailed to verify initial email was received, no response
-
Emailed to inform the public release of an advisory, CC'ed [email protected] and received a bounce on the email address
-
Public zero day release of advisory
