A WebView runs web content with the full privileges of the host app, and the JavaScript bridge is a privilege-escalation surface with no walls. On Android, addJavascriptInterface injects a Java object into every frame — including iframes — with no way to verify the caller's origin; before Android 4.2 it was outright remote code execution, and today a broad bridge plus reflected content is still cross-site scripting that runs native code with your app's permissions. web.dev confirms WebView has no real site isolation and hands the embedding app your cookies and DOM. In 2026, CVE-2026-103922 (Capacitor, CVSS 9.6) showed the same-origin boundary failing in a shipped hybrid app. A host-owned runtime draws the wall: least-privilege, origin-scoped, capability-gated.
The bridge trusts whoever calls it
The native bridge is the door between web and native, and by default it is unlocked. Android's addJavascriptInterface exposes a Java object to every frame of the WebView, including any iframe, and the platform itself notes there is no mechanism to verify the origin of the calling frame. The implication is direct: inject a malicious frame into a legitimate page and that frame can call your native methods. Apps targeting API 16 or earlier could have JavaScript fully control the host app; even today, reflecting untrusted user content into a bridge-enabled WebView is a cross-site scripting path that executes Java with the host app's permissions — privilege escalation, not a glitch. MessageChannel-based bridges are safer only if you add origin checks yourself; without them, messages are accepted from any sender.
No site isolation means no real walls
A hardened browser separates untrusted pages into isolated processes so one tab cannot read another's cookies or memory. WebView is not that. According to web.dev, before Android 8.0 the renderer ran in the same process as the embedding app, and even on newer OS, all pages and WebView instances still share a single process — so true site isolation is impossible. That is what exposed billions of devices to Meltdown and Spectre: a malicious page could attempt to read cross-origin data it should never see. WebView also hands the embedding app complete access to rendered content, including cookies and the DOM, and it lacks the security UI indicators a real browser provides — the address bar the user sees can disagree with the page actually displayed, over an HTTPS connection, with no API to detect it.
A 2026 breach made it concrete
This is not theory. In 2026, Capacitor — a mainstream hybrid framework — shipped CVE-2026-103922, scored CVSS 9.6. Its WebView navigation guard checked a target URL's scheme and host but not its path, so a crafted link could reach an internal proxy endpoint served at the application's own origin. The native layer then fetched attacker-controlled content and returned it under the app's trusted origin, letting malicious JavaScript run with same-origin privileges — reading localStorage, cookies, and any native capability exposed by registered plugins. It maps to CWE-346 (origin validation error) and CWE-441 (confused deputy). Disabling the HTTP plugin did not help, because the handler stayed available. A normal link, rendered inside the app, became a script-execution path with the app's full trust.
The runtime fix
A host-owned runtime treats the web as untrusted by default and draws an explicit security boundary. The bridge is origin-scoped and least-privilege: a page from an untrusted catalog entry cannot reach a credential or device handler, only the capabilities the host explicitly grants. Web contexts are sandboxed per entry, navigation is verified frame-by-frame, and the native layer checks, rather than trusts, every call. The wall is written in policy, not left to a default that trusts whoever knocks.
| Dimension | WebView | Host-owned runtime |
|---|---|---|
| Bridge exposure | Java object in every frame, no origin check | Origin-scoped, least-privilege, capability-gated |
| Process isolation | Single shared process, no site isolation | Sandboxed web context per catalog entry |
| Cross-origin theft | Meltdown/Spectre-class exposure | Native layer verifies every call |
| Security indicators | None; address bar can mismatch | Host-controlled, verifiable trust |
| Same-origin boundary | Trusted by default (CVE-2026-103922) | Explicit, enforced per origin |
The series keeps coming back to one word: control. A WebView trusts the web it loads and hands it the app's privileges; the boundary fails quietly and, as 2026 showed, catastrophically. A runtime makes the boundary a wall you build — per origin, per capability, per page. For a catalog of third-party pages transacting inside your app, that wall is the difference between a platform and a liability.
Sources
- Android Developers — Insecure WebView native bridges: addJavascriptInterface injects into every frame with no origin check; pre-API 17 is RCE, reflected content is XSS with host permissions — official guidance on the bridge as a privilege-escalation surface.
- web.dev — Web on Android: WebView lacks multi-process architecture and site isolation; single shared process; full access to cookies/DOM; no security UI indicators — the structural reason a WebView is not a hardened browser.
- CVE-2026-103922 (Capacitor), CVSS 9.6 — navigation guard missed URL path; internal proxy at app origin let remote content run with same-origin trust (CWE-346, CWE-441) — a 2026 hybrid-app breach from a missing boundary.
- Android Developers — Native API access via JS bridge: security ranking addWebMessageListener (allowlist) higher than addJavascriptInterface (no origin check) — why the default bridge is the weakest option.
- OWASP MASTG — Platform interaction and WebView bridge risks (MASVS-PLATFORM) — bridge and clipboard hardening mapped to mobile security requirements.
