Lukas' Notes

App-to-Web Interaction (WebView)

2 min read

web security mobile

Definition

App-to-Web Interaction (WebView)

App-to-web interaction is the direction in which the embedding app manipulates the website loaded inside a WebView. It is the attack surface under the app attacker model: the attacker controls the app and can read or modify the benign page in two ways — by injecting JavaScript and by accessing the page’s cookies.

JavaScript Code Injection

Injecting JavaScript into the loaded page

The embedding app can run arbitrary JavaScript inside the loaded page:

  • Android WebView.loadUrl("javascript:<script>") and WebView.evaluateJavaScript()
  • iOS WKWebView.evaluateJavaScript(), WKWebView.callAsyncJavaScript(), and related APIs

A PUA can use this to modify the website, monitor user interactions, and steal user data.

TikTok iOS keylogging (2022)

  • the attack
    • TikTok on iOS injected JavaScript into every website opened in its in-app browser and subscribed to keypress/keydown events
  • consequence
    • this could record all user input, including passwords and payment details typed into third-party sites
  • source
    • see the blog post of Felix Krause (2022) for the technical breakdown

Reading and writing cookies from the app

The embedding app can read and write the WebView’s cookies directly:

  • Android CookieManager.getCookie() and CookieManager.setCookie()
  • iOS WKHTTPCookieStore.getAllCookies() and WKHTTPCookieStore.setCookie()

A PUA can steal cookies this way and hijack the user’s session.

Obs

Because of this risk, Google and Facebook block “Log-in with” flows inside (WK)WebView, and the OAuth 2.0 standard explicitly warns about performing login inside an app-controlled WebView. The app’s embedding surface is not trusted to mediate third-party authentication.

Backlinks