I am very new to Android app development and I started out with the idea of fixing a small defect in an app. However, I got sucked further in and found that a payment processing company that we use has introduced a new client library that contains a security vulnerability. Therefore, I don't want to use the library. Rather than switch processors I'm trying to find a workaround. Since we use the processor's Web-based payments page for the Web app, one possibility is to embed the same web page in the Android app.

I'm wondering whether using the Web page this way inside an Android WebView would create any new vulnerabilities that I should be aware of. I'm asking about Android specifically. If anyone else has done something similar and looked into the security implications, I'd like to hear from you.

  • Have you approached your processor to ensure they're aware of the vulnerability? Have they given you any expectation around when a fix will be available? Everything else being equal, it's often better to wait a small amount for an official fix than to start doing everything yourself. – gowenfawr Sep 15 '18 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.