Android WebView camera/microphone access control

unity-webview on Android automatically grants the content inside the WebView permission to access the camera and microphone, if the application is granted the corresponding permission. This allows an attacker that manages to trick the victim into loading a malicious website into the WebView of a vulnerable application with camera/microphone permission to access those resources stealthily. Developers using unity-webview cannot deny those permissions to the content inside the WebView. Omitting the UNITYWEBVIEW_ANDROID_ENABLE_CAMERA and UNITYWEBVIEW_ANDROID_ENABLE_MICROPHONE flags has no impact when the application itself already has permissions to access those resources.

My suggestion is to add the boolean properties allowCameraAccess and allowMicrophoneAccess that can be set to true during the initialization of the WebView to allow access to the corresponding resources. For security reasons, the default value for both properties should be set to false.

Start by tracing the Android WebView permission handling and the WebView initialization path. Add the proposed camera and microphone access controls with secure defaults, and verify that embedded content is denied by default but can be allowed during initialization.