Another bug exposed by Pakistani researcher.

KARACHI: Little over a month after he helped Google Inc fix a security bug in Android's built-in browser, security researcher Rafay Baloch discovered yet another same-origin policy (SOP) bypass vulnerability in the browser's versions prior to 4.4, which allows attackers to steal personal data from millions of Android phone users.

Unlike last time when it took more than two weeks to fix the problem, the technology giant has already released patches. However, the Pakistani white-hat tells The Financial Daily that Google's security team has applied the patches to Jelly Bean users while the downstream users - those on Ice Cream Sandwich and Gingerbread - may still be at risk.

The aforesaid vulnerability, according to Baloch, carries the same consequences as he had prevented earlier in August.

He was lauded by several of the world's major technology blogs and publications for identifying the vulnerability in the Android Open Source Platform (AOSP) Browser.

The security flaw can allow a bypass of the SOP protection, which is implemented in most browsers such as Internet Explorer, Mozilla Firefox and Google Chrome, said Baloch.

"It gives attackers access to private data that can be misused -- something SOP prevents from happening."

Information security analysts had already termed the bug a 'privacy...