Overcoming Insecurities in WebViews

on YouTube ↗34m

" summary

Walks through concrete WebView fixes and demos: demonstrates a breakout from an embedded map to Google Search, shows JavaScript running in‑process on pre‑Android 8 devices, and proves file access is allowed by default on older releases. Recommends specific APIs and settings: use loadDataWithBaseURL, prefer evaluateJavascript over loadUrl for JS, enable Safe Browsing via manifest metadata, disable file/content access unless needed, enforce an allowlist for navigations, consider Custom Tabs or Jetpack WebViewCompat and try SecureWebView (CC0) for sane defaults.

AI-written summary · about

" chapters (27)

1. 0:00Web view insecurities intro
2. 1:49Web view history and basics
3. 3:41Web view versions and limits
4. 5:04Web view security classes and config
5. 7:10Disable web view metrics and debugging
6. 8:32Breakout attacks in web views
7. 10:45Secure URL loading to prevent breakout
8. 12:53JavaScript execution risks in web views
9. 13:34Clear text traffic and network config
10. 14:38HTTP Strict Transport Security
11. 16:24Local content loading with base URL
12. 18:08Safe browsing and file permissions
13. 19:53File access and content provider security
14. 20:56Content provider risks in web views
15. 22:09Disable file and content provider access
16. 22:30Cookie jar and ever cookies risks
17. 23:32Jetpack WebKit and multi-profile isolation
18. 24:14JavaScript process isolation security
19. 25:17Safe JavaScript with evaluateJavaScript
20. 26:20Sanitize JavaScript input and code injection
21. 26:42Restrict JavaScript bridge interactions
22. 27:46Jetpack JavaScript engine limits
23. 28:49Secure external navigation with custom tabs
24. 30:14Social engineering risks in web views
25. 30:37Secure web view key takeaways
26. 32:02Introducing secure web view library
27. 32:44Resources and Q&A

" related talks

• 42mOvercoming Unsecurities in WebViewsBalázs Gerlei · Android Worldwide July 2024
• 34mOvercoming JavaScript Unsecurities in WebViewsBalázs Gerlei · droidcon London 2025
• 40mSo, You Want To Use A WebView? [BAD AUDIO]Andrew Lee-Thorp · OWASP AppSec Research (AppSecEU) 2015
• 39mAndroid and the WebViewErik Hellman · droidCon Berlin 2019
• 28mControlling Safe Browsing to Protect WebViewAkihiro Shiota · DroidKaigi 2019
• 42mDangers on Android: Vulnerabilities and DefensesYuliya Stekacheva · Mobius 2024 Autumn
• 22mThe Tangled Webview ----- Javascriptinterface Once MoreCe Qin · Black Hat Asia 2021
• 27mBypassing Browser Security Policies for Fun and ProfitRafay Baloch · Black Hat Asia 2016