flawopen.com/XSS in Kotlin/addJavascriptInterface

Is Android's addJavascriptInterface safe?

Reference page — draft, pending review
Short answer

Only when the WebView it's attached to never loads untrusted content. If it does, injected script can potentially call any method you've exposed through the bridge — turning a browser-style XSS into a native-code execution path.

Why this is a bigger deal than typical XSS

Normal XSS lets an attacker's script run in a browser tab — bad, but scoped to what a browser tab can do (steal cookies, make requests as the user). addJavascriptInterface exposes real Java/Kotlin object methods to that same JavaScript. If the WebView ever renders anything an attacker influences — a remote page, cached content, a deep link's data — injected script may be able to call those native methods directly.

The safe pattern

RISKY
webView.addJavascriptInterface(
  NativeBridge(), "Android"
)
webView.loadUrl(untrustedUrl)
SAFER
// only bridge into WebViews loading
// content your app fully controls
webView.addJavascriptInterface(
  NativeBridge(), "Android"
)
webView.loadUrl(trustedInternalUrl)

FAQ

Does targeting a recent Android API level make this automatically safe?

Newer API levels (17+) require methods to be explicitly annotated with @JavascriptInterface to be exposed, closing one historical class of bypass — but the fundamental risk of bridging untrusted content remains if the WebView loads anything attacker-influenced.

References