Separate trusted and untrusted content
List the origins your WebView needs. Treat redirects, embedded frames and user-provided links as part of the navigation surface. Checking whether a URL string merely contains your domain is not a safe origin check.
Parse the URI and compare the expected scheme and host. For sensitive integrations, consider port and path rules as well. Do not accept trusted.example.attacker.test because it contains a familiar substring.
Minimize native bridges
The Android WebView security guidance describes risks from JavaScript-to-native bridges. Expose only the smallest necessary interface, and do not attach a privileged bridge to content outside your control.
| Bridge capability | Safer design question |
|---|---|
| Read local files | Can the feature use an explicit, narrowly scoped result instead? |
| Execute arbitrary actions | Can native code expose one validated operation? |
| Return account tokens | Can authentication remain in a safer dedicated flow? |
| Open supplied URLs | Are scheme, host and destination checked? |
A bridge method's name does not constrain what hostile input can request if the implementation accepts arbitrary commands or paths.
Handle navigation deliberately
Decide which links stay in the WebView and which open in an external browser or a dedicated authentication flow. Never bypass TLS errors to make a page load. Review file access, mixed content and debugging settings for the release build rather than inheriting development defaults.
Test hostile inputs in your own app
Use controlled pages to test unexpected origins, redirects, malformed URLs and missing messages. Confirm that the native side rejects unauthorized requests even when the web interface normally hides the corresponding button.
Test logout and account changes too. Cached web content should not preserve access to a previous user's sensitive state.
Use static findings as leads
APKLint can identify manifest and code indicators relevant to WebView review, but it cannot enumerate every page your server may deliver or prove the origin-validation logic is correct. Combine static inspection with runtime tests of the actual content and native bridge contract.
Sources and further reading
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
