Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
facebook/facebook-android-sdk
main @ a01d2c5
3
Fixes
0
CVEs
MEDIUM
Peak severity
33.3%
Coverage
Highlights
Credential Leak: 1 prior fix. Scrutinize any change in this area.
facebook-common/src/main/java/com/facebook/internal/WebDialog.kt: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Credential Leak: User access tokens were historically persisted to local storage during serialization because sensitive credential fields were not cleared before serialization payloads were written to disk. Developers must ensure that all classes handling user sessions explicitly nullify sensitive tokens during SerializationProxy serialization processes.
Improper Certificate Validation: The SDK contained testing-only code paths that allowed WebViews to bypass standard SSL error verification, exposing users to potential man-in-the-middle attacks. All WebView implementations must unconditionally cancel requests when facing SSL verification failures.
Information Disclosure: Sensitive video identifiers inside nested JSON fields of event parameter payloads were leaked to downstream tracking tables because nested structures were not recursively sanitized in enforcement modes.