Earlymon,
I just found this article that may interest you. It says Google knows about the problem but won't fix it. (A
very short synopsis) the url is:
http://arstechnica.com/security/2015/01/13/google-wont-fix-bug-hitting-60-percent-of-android-phones/
Yeah.
Not news and Ars Technica sensationalized that to no end.
Let's review -
That's not the same thing being discussed now.
Contrary to articles at the time, the defect in question did not affect all Android before a certain version - it hit specific versions of Android.
So let's look at the title of the article you linked -
"Google won’t fix bug hitting 60 percent of Android phones"
Google said something entirely different - they fixed the security defect in a later version of the operating system (prior to the press getting ahold of it) and that was the solution.
The press went on a feeding frenzy because 1) Apple didn't have the problem (total nonsense, Safari is a WebView/WebKit browser and the security firm they all quoted said Safari failed at a certain revision level, just like Android because WebView is cross platform) and 2) Google refused to update legacy users.
Oh the humanity.
Except when WebView was bound to the operating system Google could not update that for you anyway.
If you have a carrier branded phone in the US, you get your updates from your carrier, not Google - and if it's not carrier branded and not a Nexus, you get your updates from your phone manufacturer - again not Google.
If you were running KitKat at the time that article came out, the problem was already fixed by Google - and if you were on Gingerbread or earlier, the bug hadn't been introduced yet.
If you were affected, rooted and no carrier update was available, a simple root modification fixed it.
If you were vulnerable and not rooted and not getting an update, then using a non-WebView browser solved the problem also.
The site with the test for the vulnerability, the link to the actual security article, and the community of users at Androidforums.com coming together to share security test results is here, contemporary to the time frame of the Ars Technica hype - last January -
http://androidforums.com/threads/google-has-thrown-android-users-under-the-bus.895215/page-3
How does it relate to the issue you have with apps today that WebView is being blamed for?
Users that understood all of the above complained that they ought not be held hostage to carrier OTA updates for important web security bugs. Carriers are very slow and people ought not get screwed because their devices are past the normal update/support lifetime.
That's an excellent point.
Google agreed.
So at the next operating system opportunity - Lollipop - they decoupled WebView from the rom and made it an app that they can control individually from the Play Store - without having to go through carriers or manufacturers to get out security fixes as rapidly as possible.
And it's that update mechanism for WebView that the web today is saying that everyone ought to turn off.
So - Google refused to fix a bug - not true when claimed - problem was Android only - not true when claimed - Google could only solve future problems if they controlled all rom updates like Apple - not true when claimed (remember - news bloggers are not software engineers) - Google threw everyone under the bus - not true when claimed.
You have a WebView that is very particular about inputs and outputs being correct in number, nature and kind - more strict than before.
Something that you would expect apps to respect. Indeed, it's an absolute requirement for all software functions.
And you have apps that use the standard safety net - "If I as a programmer screw that up, I'll just have the code jump over here and do stuff."
That's absolutely common under the theory that you can't test for everything - but it doesn't make it ok, it's just a bandaid until you can find and fix the bug.
I would agree with the thread title here wholeheartedly if it said this -
Major problem with Android System, Some Apps Suck and the latest WebView proves it
EDIT and PS - this quote by Ars Technica - "Android 4.4 and 5.0, which use Blink rather than WebKit for their WebView, are unaffected." - is simply misleading.
In true Ars Technica fashion, they were simply clueless as to what Blink was and where it stood in the food chain.
This article explains - from 2013 - what Blink is - and it's what's being used on desktop Chrome, not Android -
http://thenextweb.com/google/2013/0...-on-all-platforms-in-10-weeks-with-chrome-28/
Parts of Blink were included in WebView starting in KitKat - yes. But that didn't magically make the bug go away.
Ars Technica really is a bunch of monkeys with typewriters trying to reproduce Shakespeare.