Shiny Shells, Rusty Cores: A Crowdsourced Security Evaluation of Integrated Web Browsers

Over the past decade, web browsers have expanded far beyond their traditional role as standalone applications. Today, browsers are also integrated into a wide range of consumer products—including smart TVs, e-readers, gaming consoles, and even cars—where they serve as secondary features for users. However, while users can rely on the transparent security practices and frequent updates of standalone browsers, integrated browsers often lack these guarantees.

In this paper, we assess the security of integrated browsers from two perspectives: their obsolescence and the completeness of their security policy implementations. To overcome the challenges posed by closed-source firmware and hardware, we developed a crowdsourcing framework that leverages dynamic analysis to examine the security properties of browsers integrated into consumer products. Using this framework, we conducted a study in which participants tested their personal devices, resulting in 76 enrollments across 53 unique products and 68 unique software versions. Our findings reveal that while security policies are generally fully supported, many embedded browsers rely on outdated engines—some already obsolete at product release. By reproducing publicly disclosed vulnerabilities, we illustrate that users face considerable and hidden security risks due to the presence of unpatched flaws.