Android WebView JavaScript Risks
Overview
Android WebView is a powerful component that can be misconfigured to allow serious attacks:
setJavaScriptEnabled(true)+addJavascriptInterface(): Creates a JavaScript bridge allowing web pages to call Java methods — RCE risksetAllowFileAccessFromFileURLs(true): JavaScript in file:// URLs can read other files- Loading untrusted URLs: Loading attacker-controlled URLs with full bridge access
setAllowUniversalAccessFromFileURLs(true): JavaScript in file:// can make cross-origin requests
Remediation
- Only enable JavaScript for trusted content
- Remove
addJavascriptInterface()or add@JavascriptInterfaceannotation carefully - Validate URLs before loading them in WebView
- Use
setWebContentsDebuggingEnabled(false)in production