Are Web Views in android secure?

Question

"Web Views" are views that display some online content, usually a webpage within an android app.

Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm if I'm on the right website or not. Thus making it a perfect exploit for malicious apps to serve web page that can be used for phishing, say like a fake facebook sign in page that could steal my credentials with little or no suspicion!

That being one of the issues, I'd like to have a more detailed and definitive answer.

So are Web Views secure? What risks do they contain?

Let me ask about a few points on this:-

• Does the web view pose the same security holes and flaws of the stock android browser (Because it is a derivative of it?)
• A "remember password" dialog often appears for password submission forms in Web Views. Are the apps entirely isolated from this 'password store'?
• Can apps possibly 'inject' some code into the Web View to track keystrokes/taps?
• What other parts of the Web View does the app have access to?

I hope this question isn't too broad.

Answer 1

One of the booleans available to the WebView class is setJavaScriptEnabled. Setting this to true/false will open up the normal vulnerabilities that are available through JavaScript. That said WebView has all the apis available to function as a normal browser. So all the normal precautions should be taken when writing a WebView that accepts user input (validation etc) or displaying content that is anything bust static.

Regarding your point about the remember password. If you have this functionality and save credentials in your application's WebView it won't be available to other applications on a nonrooted device. One you move into a rooted environment anything is possible.