flawopen.com/XSS in Swift/loadHTMLString

Is iOS WKWebView.loadHTMLString safe for untrusted content?

Reference page — draft, pending review
Short answer

No, not by itself — it renders exactly the HTML string it's given, script included. It's safe only once the string has been sanitized against an allow-list first.

Doing it safely

RISKY
webView.loadHTMLString(
  untrustedHtml, baseURL: nil
)
SAFER
let safeHtml = sanitize(untrustedHtml)
webView.loadHTMLString(
  safeHtml, baseURL: nil
)

The extra risk to check for

If the same WebView also registers a WKUserContentController message handler, injected script (from unsanitized content) has a potential path to call back into native Swift code — the iOS equivalent of Android's addJavascriptInterface risk. Never register a message handler on a WebView that can load untrusted HTML.

FAQ

Is the deprecated UIWebView any different?

No — it carries the identical risk, and has no additional sanitization built in either. Migrating to WKWebView is a modernization step, not a safety fix on its own.

References