Philipp Beer

Users interact with mobile devices under the assumption that the graphical user interface accurately reflects their actions, a trust fundamental to the user experience. Threat actors have long sought to undermine this relationship through tapjacking, a technique where malicious overlays are used to trick users into performing unintended actions, such as authorizing financial transactions or granting sensitive permissions. While Android has responded with increasingly strict mitigations, this cat-and-mouse game is far from over.

In this talk, we revisit the evolution of tapjacking and present TapTrap, a novel attack technique that bypasses modern Android protections. Unlike previous methods that rely on overlays, TapTrap abuses UI animations to circumvent the system’s security model. We demonstrate how a zero-permission app can leverage TapTrap to stealthily bypass the permission system and execute destructive actions. We conclude by demonstrating how TapTrap’s impact extends to the Web ecosystem and enables web clickjacking.

This workshop focuses on the security risks introduced by mobile in-app browsers, such as WebViews and Custom Tabs. Participants will learn how these embedded browsers blur traditional web and app boundaries, leading to new attack surfaces. The session will include practical hands-on experience demonstrating how these components can be misused.

Mobile operating systems provide developers with various mobile-to-Web bridges to display Web pages inside native applications. The Custom Tab (CT) mechanism provides two outstanding features to overcome the usability and security limitations of traditional WebViews: (1) it shares the state with the underlying browser, and (2) it can send information about navigations to the host application. In this presentation, we will discuss our systematic security evaluation of the CT component and show how the design of its security model did not consider cross-context state inference attacks. Additionally, we show how CTs can be exploited for fine-grained exfiltration of sensitive user browsing data, violation of Web session integrity by circumventing SameSite cookies, and how UI customization of the CT component can lead to phishing and information leakage.