Overcoming Unsecurities in WebViews
summary
WebViews default to risky behavior on many Android versions: cookies are shared per process, file and content URI access is allowed by default (up through Android 11 behaviors), and remote debugging exposes a live DOM to attackers. Practical fixes include disable file access and block content-provider URIs, override shouldOverrideUrlLoading with an allowlist of pages, prefer evaluateJavascript and use loadDataWithBaseURL to preserve CORS, enable Safe Browsing metadata, and consider AndroidX.webkit multiprocess or the JavaScript Engine or custom tabs for strong isolation.
AI-written summary · about
chapters (12)
- 0:00Overcoming WebView insecurities
- 5:19WebView classes and setup
- 9:29Breakout vulnerabilities
- 15:05Clear text traffic risks
- 19:47Opaque origin and cross-origin issues
- 23:20Safe browsing and file access
- 27:12Content provider and cookie security
- 30:21JavaScript execution risks
- 33:57Sandboxing with JS engine
- 34:17Custom tabs as secure alternative
- 36:40Secure WebView library
- 37:41Resources and Q&A
related talks
34mOvercoming Insecurities in WebViews
34mOvercoming JavaScript Unsecurities in WebViews
40mSo, You Want To Use A WebView? [BAD AUDIO]
41mAndroid and the WebView
39mAndroid and the WebView
15mModern WebView best practices
28mControlling Safe Browsing to Protect WebView
42mDangers on Android: Vulnerabilities and Defenses