MASTG-TECH-0143: Monitor File System Operations in WebViews

You can monitor any file system operations in the WebView storage directory using various techniques:

Use Method Tracing to monitor file system operations in the /data/data/<app_package>/app_webview/ directory. Regardless of whether the app uses these APIs directly, WebViews may use them internally when rendering content (e.g., JavaScript code using localStorage). So tracing calls to APIs such as open, openat, opendir, unlinkat, etc., can help identify file operations in the WebView storage directory.

In addition to tracing the method calls, you can also monitor all file operations:

• use Get Open Files to monitor file operations in that directory, e.g., with lsof -p <app_pid> | grep /app_webview/.
• or use Execution Tracing, e.g. with strace -p <app_pid>, to monitor file operations in that directory.