In the rush to create mobile apps that work across the leading
smartphones and tablets, many developers have leaned heavily on
web development tools and use embedded browsers as part of their
packaged applications. But security researchers have shown that
relying on browser technology in mobile apps—and even some
desktop apps—can result in hidden vulnerabilities in those
applications that can give an attacker access to local data and
device features through cross-site scripting. Osborn said other
vulnerabilities that have been discovered, and that in most
cases have now been patched, include Skype on Apple's iOS and
Gmail on Android and iOS. The vulnerabilities aren't limited to
mobile platforms—many desktop applications that use Webkit or
another web rendering engine have also had issues, Osborn said.
The Skype vulnerability was originally discovered on Mac OS X,
and similar bugs have been discovered and patched in the Adium
instant messaging client on OS X and Empathy social networking
client on Ubuntu.