Webview vulnerability

**Where I found it?**
Webview located at bolts/WebViewAppLinkResolver.java
we can view them by decompiling the apk file as the mentioned file is only created after the apk build in ionic app


here you can see that:
**_webView.getSettings().setJavaScriptEnabled(true);_**

The WebView Object has been activated to parse javascript inside it.
However by default when we create a WebView object JavaScript is disabled by default until and unless it is explicitly declared by the developer.
The untrusted Javascript code can call into the Java Reflection APIs exposed by the Interface and execute arbitrary commands. Some distributions of the Android Browser app have an addJavascriptInterface call tacked on, and thus are vulnerable to RCE.

****Mitigation**:**
If you turn off the setJavaScriptEnabled as follows, adversaries will not be able to run any JavaScript in order to perform XSS
**_webView.getSettings().setJavaScriptEnabled(false);_**

**SEVERITY: High**
It is not just limited to XSS because of javascript! In fact, using this, an attacker can even use JavaScript to invoke certain methods on the phone, such as sending an SMS to another number, making a call, or even getting a remote shell using tools such as Drozer.
I highly recommend an article on Github for the mitigation and understanding of the attack

https://github.com/vjex/WriteUp/blob/master/WebviewVuln.md

**More References:**
[](http://www.cvedetails.com/cve/CVE-2013-4710/
https://hackerone.com/reports/87835
https://hackerone.com/reports/499348
https://hackerone.com/reports/906433)