Android: Some MobFox banners make the WebView crash

[dasebasto]

I use MobFox SDK (v6.3.1) under AdMob mediation.

Some users running Android 4.4 experience frequent crashes, due to a low-level issue in the WebView / chromium.

I managed to obtain Logcat from some users, and the cause seems to be a malformed banner ad served by MobFox.

[...] 09-24 02:27:11.922 I/chromium( 8873): [INFO:CONSOLE(128)] "", source: https://js.ad-score.com/score.min.js?pid=1000264&tt=vt#tid=Cedato_JS_APP_Video&l1=1150096164&l2=1425272555&l3=com.lulo.scrabble.classicwords&l4=Classic%20Words%20Solo&l5=US&l6=com.lulo.scrabble.classicwords_78807938_health&uid=&uip=68.47.29.51&ref=http%3A%2F%2Fcom.lulo.scrabble.classicwords&pub_app=com.lulo.scrabble.classicwords&pub_domain=http%3A%2F%2Fcom.lulo.scrabble.classicwords&cb=1537774030240 (128) 09-24 02:27:12.282 F/libc ( 8873): Fatal signal 11 (SIGSEGV) at 0x00000628 (code=1), thread 13477 (le.classicwords)
Chromium_crash_MobFox_banner_Android4.4.txt

I have no hope that Google fix Chromium for this kind of specific crash.
But the logs should allow MobFox engineers to identify the ad content and maybe detect what's wrong in the ad.

A workaround would be greatly appreciated.

[nabriski]

ok, we can block this ad source for you. Will update here.
We'll also inform the demand partner.

[nabriski]

Do you happen to have the network log for this?

Thanks

[dasebasto]

Network logs is not something I can collect, sorry.

Blocking the ad source is quite radical. Isn't there a way to identify more precisely the problematic creatives or campaigns?

[nabriski]

It's possible, but will take more time as we need to contact the advertiser and ask to stop this ad. I will look into it.

[nabriski]

ok, I'm trying to zero in on the specific ad request to find the creative. Which time zone is this request coming from?

[dasebasto]

Time zone is Central Time Zone (currently UTC -5)

[nabriski]

We found the advertiser and will contact him now. Will update.

[aju04]

Ok good job :: Le mer. 26 sept. 2018 à 13:58, Itamar Nabriski <[email protected]> a écrit :

…

We found the advertiser and will contact him now. Will update. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#80 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Ae9myJfxh4OYE4JcqGoe1cfsErQA61j0ks5ue2vvgaJpZM4W4QQY> .

[dasebasto]

Hi Itamar.
Thanks for your updates.

Did you have a chance to examine the ad and its JS code?
It would be great if you could reproduce the crash, this way it will probably be possible via trial and error to identify which part is causing the WebView crash.

[nabriski]

Hi,

That's why asked for the network log, it contains the complete ad.
Guess I can try to debug only the URL in the app log although it may not be the entire thing. Will have this result only on Tuesday, as we're on holiday and I don't have the 4.4 phone with me here.
As this is from a demand partner we'll still need to ask him to fix it, although now we'll be able to be more specific about what.
I can still block this DSP in the mean time if you wish.