"Web Views" are views that display some online content, usually a webpage within an android app.
Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm if I'm on the right website or not. Thus making it a perfect exploit for malicious apps to serve web page that can be used for phishing, say like a fake facebook sign in page that could steal my credentials with little or no suspicion!
That being one of the issues, I'd like to have a more detailed and definitive answer.
So are Web Views secure? What risks do they contain?
Let me ask about a few points on this:-
- Does the web view pose the same security holes and flaws of the stock android browser (Because it is a derivative of it?)
- A "remember password" dialog often appears for password submission forms in Web Views. Are the apps entirely isolated from this 'password store'?
- Can apps possibly 'inject' some code into the Web View to track keystrokes/taps?
- What other parts of the Web View does the app have access to?
I hope this question isn't too broad.