So, You Want To Use A WebView? [BAD AUDIO]
summary
Android WebView exposes concrete, exploitable behaviors: JavaScript interface reflection allows arbitrary Java access even when no interface is explicitly added because the system injects interfaces; file URI same-origin lets injected script read local app files; intent:// custom-scheme can launch private activities via crafted URLs. HTTPS validation usually works with system trust but certificate pinning is hard and often misimplemented; demos show some exploits work live while others fail depending on device version and app configuration.
AI-written summary · about
chapters (21)
- 0:00Intro
- 8:06Demonstration
- 11:35Interfaces
- 12:58Testing
- 15:02Improvising
- 17:03Interception
- 19:34File Scheme
- 20:40HTTPS
- 21:26Trust Chain
- 22:32hostname verification
- 23:41trust
- 26:24targeted malware
- 26:37bug bounty
- 27:00URL schemes
- 28:14Threat model schemes
- 29:41Threat model schemes demo
- 32:15Summary
- 34:15Thank you
- 34:34Recommendations
- 36:16Extras
- 38:04Cert Printing
related talks
34mOvercoming JavaScript Unsecurities in WebViews
34mOvercoming Insecurities in WebViews
39mAndroid and the WebView
41mAndroid and the WebView
42mOvercoming Unsecurities in WebViews
42mDangers on Android: Vulnerabilities and Defenses
22mThe Tangled Webview ----- Javascriptinterface Once More
15mModern WebView best practices