WebView Attack Surface Test

Checks for window.Android / common bridge names exposed to JS

Checks for window.webkit.messageHandlers exposure

Attempts to enumerate callable methods on found bridges

Attempts to fetch a local path via file:// URI

XHR request targeting local Android shared_prefs path

Attempts access to Android content providers via URI scheme

Reads all keys from localStorage — may contain tokens or session data

Reads all keys from sessionStorage

Reads document.cookie — auth tokens, session IDs may be present

Checks if IndexedDB is accessible and can list databases

Tests if page can POST data to an arbitrary external server

Creates an <img> tag to beacon data via URL params (bypasses some CORS blocks)

Attempts to read clipboard (passwords, 2FA codes)

Injects an intent:// link to test if the WebView forwards it to the OS

Attempts to navigate to a hypothetical app:// deeplink

Reads navigator.userAgent — reveals app name, version, OS

Tests if Geolocation API is accessible without an explicit prompt

navigator.deviceMemory and hardwareConcurrency fingerprinting

Detects if page was loaded over HTTP (no TLS) vs HTTPS

Detects if a Content-Security-Policy meta tag was injected by the app

Attempts to inject an HTTP script tag while on HTTPS

Tests if eval() is blocked — important if user content ever reaches JS