Towards Secure Virtual Apps: Bringing Application-Level Isolation to Android Virtualization

App-level virtualization is a technique that allows to execute apps in a virtual environment, without them being physically installed on the device. In the context of Android, VirtualApp is among the most known virtualization frameworks, as it gained popularity on the community mainly for its ability to set multiple social media accounts on the same device. VirtualApp, due to technical limitations and the lack of a proper secure architecture, proved to break the Android Sandbox model, which is among the security mechanisms that grant app isolation. This vulnerability might be exploited by a malicious entity to get the user's personal data without consent. The purpose of this work is to better understand which attacks can be performed on VirtualApp, develop a strategy to prevent them, and implement a working proof of concept on the framework. An evaluation of real-world virtualization frameworks downloaded from the Google Play Store reveals that some of them share the same security vulnerability, exposing millions of users. A final discussion stresses the importance of secure software development practices.