Your Car’s Browser Is a Cyber Risk
▼ Summary
– Embedded browsers in devices like smart TVs and e-readers are often outdated by years, containing known security bugs and leaving users vulnerable to phishing.
– Researchers created a crowdsourced framework called CheckEngine to test these closed-source browsers, finding many newly released products already had obsolete software.
– A specific e-reader case study showed a browser remained unpatched across multiple updates, with the issue reported to EU authorities due to the vendor’s inadequate response.
– Testing of gaming application browsers revealed vulnerabilities like spoofed alert boxes for phishing and risky configurations that could enable privilege escalation attacks.
– The researchers attribute the problem to technical challenges in frameworks like Electron and vendor inattention, arguing that regulations like the EU Cyber Resilience Act are needed to compel security updates.
Many people don’t realize that the web browser built into their car, smart TV, or e-reader could be a significant security risk. Unlike the browsers on our phones and computers, which receive frequent patches, these integrated browsers are often neglected for years, leaving them riddled with known vulnerabilities. This oversight creates an open door for phishing attacks and other exploits, turning everyday devices into potential points of failure.
A recent study from researchers at KU Leuven in Belgium highlights the alarming scale of this problem. They developed a unique crowdsourced testing tool called CheckEngine to analyze the browsers in various consumer electronics. By asking volunteers to visit a specific URL on their devices, the team gathered data on 53 unique products. The findings were stark: many newly released devices contained browsers that were already several years out of date at the time of purchase. For instance, 24 out of 35 tested smart TVs and every e-reader examined had browsers lagging at least three years behind current desktop versions.
The research paper details how this neglect persists even after a device is sold. Some manufacturers advertise free updates but fail to provide any security patches for the embedded browser component. A case study focused on the Boox Note Air 3 e-ink tablet, released in early 2024. It shipped with a browser based on Chromium 85, a version from August 2020. Despite four subsequent software updates from the manufacturer, the browser itself remained completely unpatched. The researchers noted a lack of a proper security reporting channel and ultimately escalated the issue to EU regulators.
This regulatory angle is becoming increasingly critical. The EU Cyber Resilience Act, which entered into force in late 2024, establishes a transition period where vendors must eventually ensure the security of their products. The study suggests many devices currently on the market are not yet compliant with these forthcoming standards, signaling a need for urgent action from manufacturers.
The investigation also extended to popular gaming and hardware applications. Platforms like Steam, Ubisoft Connect, and AMD Adrenalin software all utilize embedded browsers for various functions. While the team could not always reproduce specific critical vulnerabilities, they found concerning security lapses. In older Steam browser versions, they demonstrated how an attacker could spoof the origin of an alert box, a technique perfect for phishing. Ubisoft Connect’s browser, though limited in some ways, was configured with a flag that disables a key security sandbox, elevating the risk of privilege escalation attacks. For AMD Adrenalin, researchers successfully reproduced an address bar spoofing vulnerability, which the company acknowledged and was addressing.
A root cause of this widespread issue appears to be the development frameworks used to build these applications. Tools like Electron bundle a browser engine with other user interface components, making isolated updates difficult and costly. Updating the browser often requires updating the entire framework, which can break dependencies and increase development overhead significantly. In other cases, however, the problem seems to stem from simple vendor inattention or a conscious decision to deprioritize essential security measures.
The researchers argue that while consumer labels or ratings might help raise awareness, broad voluntary improvement is unlikely. They conclude that strong regulations are necessary to compel manufacturers to take responsibility for the security of every component they embed, including often-overlooked browsers. As our homes and vehicles become more connected, ensuring these hidden gateways are secure is no longer optional, it’s a fundamental requirement for consumer safety.
(Source: The Register)