Search code examples
androidwebviewcross-application

Does setJavaScriptEnabled(false) fix Cross App Scripting Vulnerability

As https://support.google.com/faqs/answer/9084685 mentioned, "WebViews that enable JavaScript and load data read from untrusted Intents can be tricked by malicious apps into executing JavaScript code in an unsafe context. "

Does this mean that setJavaScriptEnabled(false) can fix the Cross App Scripting Vulnerability problem?

Solution

  • well, cross scripting won't work when you disable scripting (js) at all... look at points in Option 2 under link: all are related to JS and somehow limiting its usage. when you disable JS at all then there is nothing to limiting - scripting just doesn't work (also malicious)

    note that there is a pleny of methods for breaking your app, with WebView there is potentially twice much...