JavaScript v8 Exploit Lets Chrome Force an APK Install on Android

During the PacSec conference in Tokyo yesterday, MobilePwn2Own demoed a vulnerability in Chrome that exploits the JavaScript v8 engine and allows malicious hackers to install an application on Android without any user interaction at all. PacSec organiser Dragos Ruiu says that this exploit is rare because “it was one shot” and that most people “have to exploit several vulnerabilities” to load software without user interaction.