WebView

web security mobile

Definition

WebView

A WebView (Android) or WKWebView (iOS) is an OS-provided component that embeds a web engine inside a native app, used to show websites, display ads, build hybrid apps (e.g. Cordova), and build in-app browsers. Each WebView instance is isolated from other instances and from the system browser — it does not share cookies, cache, or other browsing data — and it supports a high level of web-app interaction in both directions: the app can manipulate the loaded page, and the page can call back into the app through a JS bridge.

Embedding Components Compared

OS-provided web-embedding components

Mobile operating systems offer several components for embedding web content in apps. They differ in whether they share browsing state with the system browser, how much web-app interaction they allow, and whether they draw a browser UI.

Component	Loads arbitrary sites	Shares state with browser	Web-app interaction	Browser UI
WebView (Android)	✅	❌	✅	❌
WKWebView (iOS)	✅	❌	✅	❌
Custom Tabs (Android)	✅	✅	⚠ restricted	✅
Trusted Web Activities (Android)	❌	✅	⚠ restricted	❌
3rd-party libraries (e.g. GeckoView)	✅	library-dependent	library-dependent	library-dependent
SFSafariViewController (iOS)	✅	⚠ restricted	⚠ restricted	✅

The two isolation columns — no shared state, no browser UI, full interaction — are what make WebView/WKWebView the risky endpoint: the embedding app fully controls the page’s surroundings, so the web-app interaction surface is the attack surface of the mobile-web threat models.

Uses

Where WebView appears

• Most apps embed the web
  • about 56% of Android apps use Android WebView
• In-app browsers on social apps
  • the in-app browser on Instagram is powered by WebView, so any links a user taps open inside the app rather than in the system browser, within the app’s embedding surface.