{"id":104,"date":"2025-11-22T21:22:18","date_gmt":"2025-11-22T21:22:18","guid":{"rendered":"https:\/\/lthcybersecurity.com\/blog\/?p=104"},"modified":"2025-11-22T21:22:18","modified_gmt":"2025-11-22T21:22:18","slug":"case-study-forensic-analysis-of-popup-artifact-persistence-in-aloha-browser-android-2020-build","status":"publish","type":"post","link":"https:\/\/lthcybersecurity.com\/blog\/case-study-forensic-analysis-of-popup-artifact-persistence-in-aloha-browser-android-2020-build\/","title":{"rendered":"Case Study: Forensic Analysis of Popup Artifact Persistence in Aloha Browser (Android, 2020 Build)"},"content":{"rendered":"

LTH Cybersecurity conducted a controlled forensic investigation to determine whether a 2020-era build of the Aloha Browser (v2.x, Chromium\/WebView ~80) records internal database artifacts when popups are triggered without direct user interaction<\/strong>.<\/p>\n

Key Finding:<\/strong>
Across all tested scenarios\u2014including redirect chains, iframe triggers, timer-based popups, and programmatic window.open() calls\u2014no automatic entries were ever written<\/strong> to the browser\u2019s internal allow_popup_sites<\/code> table.<\/p>\n

Only user-initiated permissions<\/strong> created database artifacts.
All bypass or non-gesture events produced zero trace evidence<\/strong>.<\/p>\n

This behaviour has major implications for legal investigations, digital harassment cases, and WebView forensics.<\/p>\n

\n

Background & Importance<\/strong><\/h2>\n

During several real-world investigations, analysts and legal teams have relied on the presence (or absence) of popup permission entries as evidence of a user\u2019s actions or browser behaviour.<\/p>\n

However, Chromium\/WebView engines between 2018\u20132020 had known popup-related gesture bypasses, inconsistent iframe behaviour, and exploitable redirect heuristics.<\/p>\n

This case study sought to answer a critical forensic question:<\/p>\n

\n

Can popups be triggered in Aloha Browser without leaving any evidence inside the browser\u2019s SQLite database?<\/strong><\/p>\n<\/blockquote>\n

The results were definitive: yes<\/strong>.<\/p>\n

\n

Test Environment<\/strong><\/h2>\n

All testing was performed under strict, isolated conditions to ensure forensic integrity.<\/p>\n

Devices<\/strong><\/h3>\n
    \n
  • \n

    Samsung Galaxy S8<\/strong><\/p>\n

      \n
    • \n

      Android 9 (Pie)<\/p>\n<\/li>\n

    • \n

      ARM64<\/p>\n<\/li>\n<\/ul>\n<\/li>\n

    • \n

      (S9 results coming next)<\/em><\/p>\n<\/li>\n<\/ul>\n

      Browser<\/strong><\/h3>\n
        \n
      • \n

        Aloha Browser early 2020 build<\/strong><\/p>\n

          \n
        • \n

          Approximately v2.9.x<\/p>\n<\/li>\n

        • \n

          Chromium\/WebView engine ~80<\/p>\n<\/li>\n

        • \n

          Full bundle installed (base + native libraries)<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

          Isolation & Controls<\/strong><\/h3>\n
            \n
          • \n

            WiFi disabled<\/p>\n<\/li>\n

          • \n

            All outbound traffic blocked<\/p>\n<\/li>\n

          • \n

            Local content loaded only over 127.0.0.1<\/code> using adb reverse<\/code><\/p>\n<\/li>\n

          • \n

            No internet or external domains reachable<\/p>\n<\/li>\n

          • \n

            Host NIC traffic monitored continuously (no packets observed)<\/p>\n<\/li>\n<\/ul>\n

            Tools<\/strong><\/h3>\n
              \n
            • \n

              ADB (file extraction, DB pulls)<\/p>\n<\/li>\n

            • \n

              SQLite3 CLI viewer<\/p>\n<\/li>\n

            • \n

              Local HTTP server<\/p>\n<\/li>\n

            • \n

              SHA256 hashing utility<\/p>\n<\/li>\n

            • \n

              Screen recording \/ logs<\/p>\n<\/li>\n<\/ul>\n

              Wireshark captured no traffic\u2014as expected\u2014because all test traffic remained inside the Android device<\/strong> and never traversed a physical or virtual host adapter.<\/p>\n

              \n

              Test Scenarios<\/strong><\/h2>\n

              Each scenario was repeated three times<\/strong> with a clean baseline snapshot for every run.<\/p>\n

                \n
              1. \n

                Baseline control<\/strong><\/p>\n

                  \n
                • \n

                  User manually allows popups \u2192 expected DB entry<\/p>\n<\/li>\n<\/ul>\n<\/li>\n

                • \n

                  Redirect chain<\/strong><\/p>\n

                    \n
                  • \n

                    Multi-step 3xx \u2192 window.open()<\/p>\n<\/li>\n<\/ul>\n<\/li>\n

                  • \n

                    Nested iframes<\/strong><\/p>\n

                      \n
                    • \n

                      Child iframe attempts to trigger a popup<\/p>\n<\/li>\n<\/ul>\n<\/li>\n

                    • \n

                      Programmatic popups<\/strong><\/p>\n

                        \n
                      • \n

                        timers, onload triggers, JS-driven calls<\/p>\n<\/li>\n<\/ul>\n<\/li>\n

                      • \n

                        Prefetch \/ background fetch<\/strong><\/p>\n<\/li>\n

                      • \n

                        Restore \/ import test<\/strong><\/p>\n

                          \n
                        • \n

                          Attempt to import previously exported DB data<\/p>\n<\/li>\n

                        • \n

                          (Aloha 2.x does not support import in a meaningful way)<\/em><\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n

                          For every run:<\/p>\n

                            \n
                          • \n

                            Pre-test DB pulled + hashed<\/p>\n<\/li>\n

                          • \n

                            Test executed<\/p>\n<\/li>\n

                          • \n

                            Post-test DB pulled + hashed<\/p>\n<\/li>\n

                          • \n

                            SHA256 digests compared<\/p>\n<\/li>\n

                          • \n

                            DB inspected for new entries<\/p>\n<\/li>\n<\/ul>\n

                            \n

                            Results Overview<\/strong><\/h2>\n

                            Scenario 1: Baseline<\/strong><\/h3>\n

                            User manually allowed popups \u2192
                            1 new entry added<\/strong> to allow_popup_sites<\/code> (as expected).<\/p>\n

                            Scenario 2: Redirect Chains<\/strong><\/h3>\n

                            In all three runs:<\/p>\n

                              \n
                            • \n

                              Popups triggered successfully<\/p>\n<\/li>\n

                            • \n

                              No DB entries created<\/strong><\/p>\n<\/li>\n<\/ul>\n

                              Scenario 3: Nested Iframes<\/strong><\/h3>\n
                                \n
                              • \n

                                Popups never triggered<\/strong><\/p>\n<\/li>\n

                              • \n

                                DB unchanged in all runs<\/p>\n<\/li>\n

                              • \n

                                Matches known WebView limitations from Chromium 70\u201380<\/p>\n<\/li>\n<\/ul>\n

                                Scenario 4: Programmatic Triggers<\/strong><\/h3>\n
                                  \n
                                • \n

                                  Timers and JS events fired<\/p>\n<\/li>\n

                                • \n

                                  Popups opened<\/p>\n<\/li>\n

                                • \n

                                  No permission entries created<\/strong><\/p>\n<\/li>\n<\/ul>\n

                                  Scenario 5: Prefetch \/ Background Fetch<\/strong><\/h3>\n
                                    \n
                                  • \n

                                    No user gesture \u2192 no UI event<\/p>\n<\/li>\n

                                  • \n

                                    No DB changes<\/strong><\/p>\n<\/li>\n<\/ul>\n

                                    Scenario 6: Restore \/ Import<\/strong><\/h3>\n
                                      \n
                                    • \n

                                      Aloha 2.x does not support importing data in a way that affects popup artifacts<\/p>\n<\/li>\n

                                    • \n

                                      Re-importing the DB produced no behavioural change<\/strong><\/p>\n<\/li>\n

                                    • \n

                                      Zero entries added<\/strong><\/p>\n<\/li>\n<\/ul>\n

                                      \n

                                      \ud83d\udd0d Core Forensic Conclusion<\/strong><\/h1>\n

                                      Bypass popups do not trigger Aloha Browser\u2019s permission pipeline.<\/strong>
                                      And because the permission pipeline is the only<\/em> mechanism that writes to allow_popup_sites<\/code>, the SQLite database shows no evidence whatsoever<\/strong>, even though visible popups occurred.<\/p>\n

                                      This means:<\/p>\n

                                        \n
                                      • \n

                                        The absence of database entries<\/p>\n<\/li>\n

                                      • \n

                                        cannot<\/strong> be used to prove popups did not occur<\/p>\n<\/li>\n

                                      • \n

                                        and cannot<\/strong> be used to infer user action or consent<\/p>\n<\/li>\n<\/ul>\n

                                        This is a significant forensic limitation.<\/p>\n

                                        \n

                                        Why This Matters for Legal & Investigative Work<\/strong><\/h2>\n

                                        This finding is crucial for:<\/p>\n

                                        \u2714 Digital harassment cases<\/strong><\/h3>\n

                                        An attacker could trigger popups without leaving trace artifacts, meaning the victim\u2019s browser logs won’t show anything.<\/p>\n

                                        \u2714 Criminal defence & digital evidence challenges<\/strong><\/h3>\n

                                        A missing DB entry does not<\/strong> imply the user did not experience unwanted popup activity.<\/p>\n

                                        \u2714 Mobile forensics & expert testimony<\/strong><\/h3>\n

                                        This test demonstrates a reproducible blind spot in Aloha\u2019s 2020 WebView behaviour.<\/p>\n

                                        \u2714 Corporate security & fraud investigations<\/strong><\/h3>\n

                                        Popup-driven phishing or malvertising could occur without forensic persistence.<\/p>\n

                                        \n

                                        Technical Quote for Reports<\/strong><\/h2>\n
                                        \n

                                        \u201cIn Aloha Browser v2.x (WebView ~80), popup events triggered without user gesture do not invoke the permission callback responsible for writing to the \u2018allow_popup_sites\u2019 SQLite table. As a result, non-interactive popup behaviour leaves zero database artifacts and cannot be reconstructed from the browser\u2019s internal state.\u201d<\/em><\/p>\n<\/blockquote>\n

                                        \n

                                        Artifacts & Integrity<\/strong><\/h2>\n

                                        All collected artifacts were hashed using SHA256<\/strong>:<\/p>\n

                                          \n
                                        • \n

                                          Baseline DB files<\/p>\n<\/li>\n

                                        • \n

                                          All pre\/post lab DB extractions<\/p>\n<\/li>\n

                                        • \n

                                          Video recordings<\/p>\n<\/li>\n

                                        • \n

                                          Final zipped deliverable<\/p>\n<\/li>\n

                                        • \n

                                          Manifest documenting each file\u2019s hash<\/p>\n<\/li>\n<\/ul>\n

                                          These are available in the final deliverable package.<\/p>\n

                                          \n

                                          About LTH Cybersecurity<\/strong><\/h2>\n

                                          LTH Cybersecurity specializes in:<\/p>\n

                                            \n
                                          • \n

                                            Mobile application forensics<\/p>\n<\/li>\n

                                          • \n

                                            Browser behaviour analysis<\/p>\n<\/li>\n

                                          • \n

                                            Digital investigations<\/p>\n<\/li>\n

                                          • \n

                                            Vulnerability research<\/p>\n<\/li>\n

                                          • \n

                                            Isolated testbed construction<\/p>\n<\/li>\n

                                          • \n

                                            Reproducible forensic methodologies<\/p>\n<\/li>\n<\/ul>\n

                                            If your organization requires high-integrity, legally defensible mobile browser analysis or expert testimony, LTH can help.<\/p>\n","protected":false},"excerpt":{"rendered":"

                                            LTH Cybersecurity conducted a controlled forensic investigation to determine whether a 2020-era build of the Aloha Browser (v2.x, Chromium\/WebView ~80) records internal database artifacts when popups are triggered without direct user interaction. Key Finding:Across all tested scenarios\u2014including redirect chains, iframe triggers, timer-based popups, and programmatic window.open() calls\u2014no automatic entries were ever written to the browser\u2019s […]<\/p>\n","protected":false},"author":1,"featured_media":105,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-104","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/posts\/104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/comments?post=104"}],"version-history":[{"count":2,"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/posts\/104\/revisions"}],"predecessor-version":[{"id":116,"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/posts\/104\/revisions\/116"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/media\/105"}],"wp:attachment":[{"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/media?parent=104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/categories?post=104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lthcybersecurity.com\/blog\/wp-json\/wp\/v2\/tags?post=104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}