Shiny Shells, Rusty Cores - A Crowdsourced Security Evaluation of Integrated Web Browsers

Explore a 12-minute conference presentation examining the hidden security vulnerabilities in web browsers integrated into consumer devices like smart TVs, e-readers, gaming consoles, and cars. Learn about a novel crowdsourcing framework developed by researchers from KU Leuven that uses dynamic analysis to assess the security properties of embedded browsers in closed-source firmware and hardware environments. Discover findings from a comprehensive study involving 76 device enrollments across 53 unique products, revealing how integrated browsers often rely on dangerously outdated engines—some already obsolete at product release—despite generally supporting complete security policy implementations. Understand the significant and often hidden security risks users face due to unpatched vulnerabilities in these embedded browser systems, demonstrated through reproduction of publicly disclosed security flaws. Gain insights into the stark contrast between the transparent security practices of standalone browsers and the concerning lack of security guarantees in integrated browser implementations across consumer electronics.