XSS in Android WebView: Risks, Tradeoffs, and Fixes
Android WebView is one of those features that feels harmless right up until it becomes your app’s biggest security problem. If you render untrusted HTML, expose Java objects to JavaScript, or load mixed app and remote content into the same WebView, you are building an XSS target. The twist is that XSS in WebView is often worse than browser XSS, because the payload can sometimes reach native app capabilities. That changes the impact from “someone ran JavaScript in a page” to “someone ran JavaScript inside my app.” ...