I heard that WebView vulnerability is active in Android versions before 4.2. I read that it is fixed by Google in their newer updates from 4.2. What I want to know is a brief description of the WebView vulnerability, like, how an attacker can use this vulnerability and any solution to fix this by myself in my app if it is possible to secure my Android app from this vulnerability.
The primary vulnerabilties involved in the WebView component are Insecure Direct Object References, SQL Injection, and Cross-Site Scripting (XSS).
Or, if you can't do this, be sure that each context is escaped properly by using an XSS filter component such as the OWASP Java Encoder Project.
You can see what data is available to each WebView by using the sqlite3 command-line tool or a SQLite3-compatable browser to view the /app/-packagename-/db/webview.db file. Of course, any input that makes its way into the SQLite3 database or that performs a query or other string operation against it can become a potential insertion point for SQL injection -- albeit in some cases a network MITM scenario may be required.
Some examples of insecure direct object references can be found in these penetration testing tutorials against the HerdFinancial app which is a part of the OWASP GoatDroid Project:
WebView can also be exploited by malicious websites as there's no way to know if a site has been labeled as malware or phishing. And most of the time, developers don't display the URL so end-users can't even check to see if the site is what they think it is. We've just launched a Security API to address this problem https://metacert.com/api-documentation/getting-started/ would love to hear your thoughts on the API and documentation - you can use the free service with no contract.