Controlling Safe Browsing to Protect WebView

on YouTube ↗28m

" summary

Android WebView includes Google Safe Browsing by default on v66 and newer to block phishing, malware, and unwanted software. Apps can call startSafeBrowsing and handle a SafeBrowsingResponse with three possible actions (show an interstitial, navigate back to safety, or proceed), set per‑WebView enablement and a host whitelist, and should use compatibility helpers for behavior around API level 26. Chrome shows a red interstitial only when the WebView fills the root width and at least 70% of height, and SafetyNet Safe Browsing depends on Play Services 8.1+ (so it won’t work on devices without Play Services).

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 5:34Unsafe websites
3. 14:07WebViewCompat#startSafeBrowsing
4. 16:52WebViewClientCompat#onSafeBrowsingHit
5. 22:37WebViewCompat#setSafeBrowsingWhitelist
6. 23:35When to use disable/exclusion settings

" related talks

• 34mOvercoming Insecurities in WebViewsBalázs Gerlei · droidcon London 2024
• 42mOvercoming Unsecurities in WebViewsBalázs Gerlei · Android Worldwide July 2024
• 15mModern WebView best practicesNate Fischer, Richard Coles, Toby Sargeant · Android Dev Summit 2018
• 39mAndroid and the WebViewErik Hellman · droidCon Berlin 2019
• 40mSo, You Want To Use A WebView? [BAD AUDIO]Andrew Lee-Thorp · OWASP AppSec Research (AppSecEU) 2015
• 22mChrome and Android: Past, Present, FutureShinobu Okano · DroidKaigi 2016
• 34mOvercoming JavaScript Unsecurities in WebViewsBalázs Gerlei · droidcon London 2025
• 39mO-mg what's new in Android Security?Scott Alexander-Bown · droidcon NYC 2017