Skip to content

MASWE-0033: Sensitive Native Functionality Exposed in WebViews

MAS Requirement

The app does not expose sensitive native functionality to WebView content.

Mappings

MASVS V1: MSTG-PLATFORM-7

MASVS V2: MASVS-PLATFORM-2, MASVS-STORAGE-2

CWE: CWE-749: Exposed Dangerous Method or Function, CWE-94: Improper Control of Generation of Code ('Code Injection')

Android Risks: insecure-webview-native-bridges

Android Core Quality: WebView_JavaScript

Overview

This weakness occurs when an app exposes sensitive native functionality to content loaded in its WebViews, most commonly through JavaScript bridges.

Bridges such as addWebMessageListener on Android and WKScriptMessageHandler on iOS allow web content to send messages to native code. When these bridges expose more capability than necessary, or are reachable by untrusted content, malicious JavaScript can invoke native functionality, access sensitive data, or perform privileged actions using the app's permissions and privileges.

Modes of Introduction

  • Bridges Reachable by Untrusted Content: Making bridge interfaces available to any page, origin, or frame the WebView loads instead of restricting them to trusted origins.
  • Unvalidated Bridge Messages: Accepting message names, arguments, or payloads without validating their structure, types, values, authorization, and expected application state.
  • Globally Exposed Bridge Mechanisms: Using bridge mechanisms that expose native interfaces broadly across the WebView, such as Android addJavascriptInterface, when origin-scoped messaging APIs are available.
  • App-Owned Bridge Scripts in the Page World: Running injected bridge scripts in the same JavaScript execution world as page content, allowing page scripts, including third-party scripts, to access or interfere with the bridge.
  • Sensitive Data in Bridge Replies: Returning sensitive data into the WebView JavaScript context in a way that any untrusted scripts can read, regardless of user authentication state.
  • Over-Exposed Bridges: Exposing more native functionality through the bridge than the web content actually needs.

Impact

  • Compromise of Sensitive Data: Attackers can call bridge methods that return user or app data, resulting in exfiltration of sensitive information to attacker-controlled servers.
  • Execution of Unauthorized Code: Attackers can drive native functionality exposed through the bridge, resulting in privileged actions performed within the app's context.

Mitigations

  • Minimize the Bridge Surface: Expose only the specific methods the web content needs, and strip bridges entirely from WebViews that do not need them.
  • Restrict Bridges to Trusted Origins: Attach bridges only when loading trusted content and prefer origin-scoped messaging mechanisms over global bridges.
  • Validate Bridge Messages: Treat every message arriving over the bridge as untrusted input and validate it before acting on it.
  • Prefer Modern Messaging APIs: On Android, prefer WebViewCompat.addWebMessageListener over the legacy WebView.addJavascriptInterface. On iOS, use WKScriptMessageHandlerWithReply when JavaScript requires a native response, and use WKScriptMessageHandler for one way messages.
  • Isolate App-Owned Bridge Scripts: When the bridge is intended only for app-injected JavaScript, register the handler and injected script in a named execution world. Use JavaScriptExecutionWorld on Android and WKContentWorld on iOS, where supported. Keep origin restrictions, frame checks, and message validation in place, because execution world isolation is not origin authorization.

Tests

No Tests Yet

The MASTG doesn't contain any tests for this weakness yet. If you have proposals or would like to work on some, please open an issue in https://github.com/OWASP/mastg/issues indicating the MASWE-0033 mapping, the test titles and a summary of the tests.