Lukas' Notes

JavaScript Bridge

2 min read

web security mobile

Definition

JavaScript Bridge

A JavaScript bridge (JS bridge) is a mechanism that exposes native app functions to a webpage loaded in a WebView, so the page can call into the app through ordinary JavaScript. It is the attack surface under the web attacker model in the mobile-web setting, i.e. the web-to-app direction: an attacker-controlled website calls exposed native functions inside the embedding app.

Mechanism

Exposing a native function to JavaScript

The app annotates a method and registers an object under a name that the page can reach:

class Foo {
    @JavascriptInterface
    String myFunction() {
        return getUserContacts();
    }
}
webView.addJavascriptInterface(new Foo(), "obj");

The loaded page then calls it as window.obj.myFunction(). The equivalent APIs exist on WKWebView. The bridge turns a website into something that can act in the context of the app, with the app’s permissions.

Risk

Warning

Under the web attacker model a malicious website loaded in the app’s WebView can call any exposed bridge function and thereby leak sensitive information or perform unwanted actions in the context of the app — read contacts, files, location, or trigger privileged operations the app is allowed to perform. The bridge widens the standard same-origin boundary: a page that the browser would never let call native code on its own is suddenly able to, because the app opted in. Exposing the narrowest possible surface, and never exposing privileged operations, is the only safe use.

Backlinks