Skip to content

Call to dangerous WebView settings API

Call to dangerous WebView settings API

Description

List of all WebView methods used in the application.

Recommendation

To Mitigate Dangerous WebView API Usage:

Primary Defense – Disable Mixed Content:

Native Android (Java): 

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
    webView.getSettings().setMixedContentMode(WebSettings.MIXED_CONTENT_NEVER_ALLOW);
}

Flutter (e.g., flutter_inappwebview):

InAppWebViewSettings(mixedContentMode: MixedContentMode.MIXED_CONTENT_NEVER_ALLOW)
  • Prevents HTTPS pages from loading insecure HTTP resources
  • Stops man-in-the-middle attacks via injected scripts

Restrict File Access:

Native Android (Java):

webView.getSettings().setAllowFileAccess(false);
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
    webView.getSettings().setAllowFileAccessFromFileURLs(false);
    webView.getSettings().setAllowUniversalAccessFromFileURLs(false);
}

Flutter (e.g., flutter_inappwebview):

InAppWebViewSettings(
  allowFileAccess: false,
  allowFileAccessFromFileURLs: false,
  allowUniversalAccessFromFileURLs: false,
)
  • Blocks file:// scheme exploitation
  • Prevents local file and database leakage

Harden JavaScript Interface:

Native Android (Java):

webView.removeJavascriptInterface("interfaceName"); // Remove if not needed
// If required, only expose minimal @JavascriptInterface methods

Flutter: Remove unused JS handlers. If required, securely restrict logic within addJavaScriptHandler (flutter_inappwebview) or JavascriptChannel (webview_flutter).

  • Avoids remote code execution via addJavascriptInterface()
  • Use WebMessagePort or allowlist trusted origins if JS bridge is required

Additional Protections:

  • Disable WebView debugging in production: Native Android:
WebView.setWebContentsDebuggingEnabled(false);

Flutter (e.g., flutter_inappwebview):

InAppWebViewSettings(isInspectable: false, debuggingEnabled: false)
  • Enable Safe Browsing (API 26+): Native Android:
WebView.enableSafeBrowsing(context);

Flutter (e.g., flutter_inappwebview):

InAppWebViewSettings(safeBrowsingEnabled: true)

By disabling mixed content, restricting file access, and securing JavaScript bridges, you eliminate the primary attack vectors associated with dangerous WebView APIs while keeping the app’s WebView functionality secure.

Standards

  • OWASP_MASVS_L1:
    • MSTG_PLATFORM_6
    • MSTG_PLATFORM_5
  • OWASP_MASVS_L2:
    • MSTG_PLATFORM_6
    • MSTG_PLATFORM_5
  • OWASP_MASVS_v2_1:
    • MASVS_PLATFORM_2
    • MASVS_PLATFORM_3
  • OWASP_MOBILE_TOP_10:
    • M8_2024