This is not the first time it happens, and unfortunately it won't be the last. Sooner or later, every company must face the dilemma of redirecting resources to extend support to its oldest products, or moving forward and affect a large number of users. Google is at that crossroads. A new bug present in Android 4.3 or earlier affects 60 percent of smartphones, but everything seems to indicate that there will be no official patch to fix it.
In recent days we have had the feeling that Google is going through a serious problem when it comes to reporting and publishing bugs. Its last clash with Microsoft provoked several shots across the border, but now it's time for something more intimate, so to speak: Android. Despite the efforts made by Mountain View, it is impossible to hide the effects of Android fragmentation when it comes to updating it. A good part of the responsibility lies with OEMs and carriers, and their policies of updates are a clear example of what not to do. This has led to the formation of a perfect storm, where we have the majority of the market with old versions of Android on devices that cannot be updated by conventional methods. At this point, some might think of alternative builds like CyanogenMod, but its application is too artisanal, and the project managers have not found a way to drastically simplify the installation process.
The latest news takes us to a bug present in the WebView component (basically, it renders web pages on the device, even inside other applications), which in turn is based on a version of WebKit. On Android KitKat and above, WebKit was replaced by the Blink engine, so the bug does not exist. However, according to Google's official numbers, 39.1 percent of users are using KitKat (Android 5.0 is below 0.1 percent), while the remaining 60.9 percent have Android 4.3 or earlier. In other words, more than half of the Android ecosystem is exposed to this bug. Tod Breasley, one of the developers of the Metasploit Framework, communicated with the incident managers at Android, and they confirmed that they cannot do anything beyond notifying OEMs. If the affected versions are earlier than Android 4.4, Google generally does not develop patches, but welcomes any fix that accompanies the corresponding report (which will be taken into consideration, and if appropriate, transferred to partners), or that is placed directly in AOSP. Other components will still receive updates via “back-port”, but WebView pre-KitKat, is done for.
One of the reasons behind this decision is that Google no longer certifies devices that include the Android Browser. And to this is added another questionable decision, which is to not offer any kind of public comment about Android vulnerabilities. In fact, the only general reference developers have to detect the fix of a bug is the message associated with the “commit” in the code. The great pain that Android suffers in the background was exposed by the folks at Ars Technica: Google created a platform that it cannot update directly. Mountain View's official devices or those labeled “Google Play Edition” represent only a fraction of the market. The rest is almost religiously blocked by OEMs and carriers, who prefer to sell new devices rather than consume resources providing support. In other words, Android does not have a “Windows Update”. At least as far as WebView is concerned, three-fifths of the Android market has just been declared obsolete. Something tells me this story isn't going to end here.
Ars Technica
