# Android WebView JavaScript Risks

> Detects insecure Android WebView configurations enabling XSS, JavaScript bridge abuse, and remote code execution.

- Skill: `zakirkun/android-webview-javascript-risks` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/android-webview-javascript-risks`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/android-webview-javascript-risks/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/android-webview-javascript-risks

---


# Android WebView JavaScript Risks

## Overview
Android WebView is a powerful component that can be misconfigured to allow serious attacks:
1. **`setJavaScriptEnabled(true)` + `addJavascriptInterface()`**: Creates a JavaScript bridge allowing web pages to call Java methods — RCE risk
2. **`setAllowFileAccessFromFileURLs(true)`**: JavaScript in file:// URLs can read other files
3. **Loading untrusted URLs**: Loading attacker-controlled URLs with full bridge access
4. **`setAllowUniversalAccessFromFileURLs(true)`**: JavaScript in file:// can make cross-origin requests

## Remediation
- Only enable JavaScript for trusted content
- Remove `addJavascriptInterface()` or add `@JavascriptInterface` annotation carefully
- Validate URLs before loading them in WebView
- Use `setWebContentsDebuggingEnabled(false)` in production