一句话：发现并测量 WebView 小程序生态中的跨小程序 Cookie 共享（CMCS）漏洞，开发静态检测工具 MiCoScan。
小程序以 WebView 渲染，破坏其隔离机制并引入新攻击面。本文提出跨小程序 Cookie 共享（CMCS）漏洞：同一 WebView 上下文中，一个小程序可访问另一个小程序设置的 Cookie，导致未授权数据交换。作者分析微信、支付宝、抖音、百度四大平台，确认均受影响并获两个 CVE；还展示特权小程序经 Cookie 向无特权小程序泄露敏感数据的合谋攻击。为测量影响，提出静态分析工具 MiCoScan：通过 WebView 上下文建模识别共享域的小程序簇，并用跨 WebView 数据流分析检测敏感数据传输。对 351,483 个小程序的分析发现 45,448 个共享域簇、7,965 次特权数据传输和 9,877 个易受合谋攻击的小程序，表明该风险广泛存在。
Mini-programs, an emerging mobile application paradigm within super-apps, offer a seamless and installation-free experience. However, the adoption of the web-view component has disrupted their isolation mechanisms, exposing new attack surfaces and vulnerabilities. In this paper, we introduce a novel vulnerability called Cross Mini-program Cookie Sharing (CMCS), which arises from the shared web-view environment across mini-programs. This vulnerability allows unauthorized data exchange across mini-programs by enabling one mini-program to access cookies set by another within the same web-view context, violating isolation principles. As a preliminary step, we analyzed the web-view mechanisms of four major platforms, including WeChat, AliPay, TikTok, and Baidu, and found that all of them are affected by CMCS vulnerabilities. These findings were responsibly disclosed and acknowledged with two CVEs. Furthermore, we demonstrate the collusion attack enabled by CMCS, where privileged mini-programs exfiltrate sensitive user data via cookies accessible to unprivileged mini-programs. To measure the impact of collusion attacks enabled by CMCS vulnerabilities in the wild, we developed MiCoScan, a static analysis tool that detects mini-programs affected by CMCS vulnerabilities. MiCoScan employs web-view context modeling to identify clusters of mini-programs sharing the same web-view domain and cross-webview data flow analysis to detect sensitive data transmissions to/from web-views. Using MiCoScan, we conducted a large-scale analysis of 351,483 mini-programs, identifying 45,448 clusters sharing web-view domains, 7,965 instances of privileged data transmission, and 9,877 mini-programs vulnerable to collusion attacks. Our findings highlight the widespread prevalence and significant security risks posed by CMCS vulnerabilities, underscoring the urgent need for improved isolation mechanisms in mini-program ecosystems.
DOI 原文 ·
@inproceedings{paperbot9433,
title = {Demystifying Cookie Sharing Risks in WebView-based Mobile App-in-app Ecosystems},
author = {Miao Zhang and Shenao Wang and Guilin Zheng and Yanjie Zhao and Haoyu Wang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00142}
}