A zero-day vulnerability generally refers to a vulnerability that is being exploited before a patch is available, or, more broadly, before the vendor has had an opportunity to address it. This should theoretically be covered by Murena’s backport policy, as described in their previous security statement. However, something about the current situation still concerns me.
From Google’s perspective, the vulnerabilities fixed in Android WebView versions 149.x, 150.x, and 151.x were not zero-days, because Google released patches before there was evidence that they were being exploited. That’s fine as far as Google’s definition is concerned. But what happens if a system doesn’t receive those patches and one of those vulnerabilities is subsequently exploited?
Would Google monitor previously patched vulnerabilities and notify Murena if one of them starts being exploited, so that Murena can then backport the corresponding fix to an outdated WebView version? I’m not convinced that this is how the process works. How would Google even track the different WebView versions used by the various custom ROMs?
I assume that the intended process is something like this: if Google discovers a zero-day vulnerability—i.e. one for which Google itself does not yet have a patch—it releases a fix, and Murena can then backport that fix to its supported WebView version. But if Google has already released a patch and e/OS has deliberately not incorporated it—for example, because development resources are currently focused on the browser app—the situation seems different. If that vulnerability is later exploited in the wild, the affected e/OS systems would still be vulnerable even though a patch has existed for months.
In that scenario, I wouldn’t expect Google necessarily to contact Murena and say, “This vulnerability from four months ago is now being exploited, so you should apply the patch we already released.” Presumably, Murena would need to identify that development independently and decide to backport the fix. At that point, we’re essentially relying on Murena to detect when a previously patched vulnerability, whose fix was not incorporated into e/OS, starts being actively exploited. That is what I find increasingly concerning, especially since Murena can’t have the same detection abilities as Google has.
There is an additional reason for concern: some of the fixes included in Google’s WebView 149.x–151.x releases were classified as critical, including vulnerabilities that could potentially allow an attacker to escape the browser’s sandbox. Even if these were not technically zero-day vulnerabilities at the time Google disclosed and patched them, I would still consider leaving such fixes unimplemented for an extended period problematic.
