WebView Origin Confusion -> Local-Only IPC

← Native / WebView Bridge (JS <-> Native)

webview_origin_confusion_ipc   HARD

Description

The WebView IPC layer classifies the caller’s origin incorrectly, so a remote page is treated as the local/trusted application origin and can invoke local-only, privileged IPC commands it should never reach (Tauri WebView IPC origin confusion CVE-2026-42184 class).

How it works

A WebView IPC layer decides whether a call is from the local/trusted application origin before it will run local-only, privileged IPC commands. The vulnerable classifier uses a sloppy substring/contains check, so a remote page whose host merely contains the local host token “localhost” is misclassified as the local origin and the privileged command executes (Tauri WebView IPC origin-confusion CVE-2026-42184 class). This runs in a real WebView: the page posts the command with an attacker Origin over a native IPC channel and the misclassified caller reaches the privileged command (the in-memory panels are the offline contrast). The secure path does an exact canonical-origin comparison (scheme, host, and port) so only the true local origin is trusted.

How to exercise it. DVMA is the harness - open this module from the home index and tap the demo action. The screen ships the malicious input and simulates the attacker (e.g. the companion app, crafted intent, or scanned payload) in-process, and the evidence panel prints the proof. The Tools (optional) and Attack inputs below are only needed to reproduce the exploit end-to-end on a real device.

Exploit steps

1. Set up. Build DVMA with a flavor that enables the Native / WebView Bridge (JS <-> Native) category (e.g. --dart-define-from-file=config/flavors/dev.json) and run on an emulator/simulator you control. The demo needs no external tooling; for the optional on-device reproduction the relevant tools are: mitmproxy, r2frida, frida · Android: jadx · iOS: ipsw, class-dump.
2. Locate the target. From the home index, open WebView Origin Confusion -> Local-Only IPC (webview_origin_confusion_ipc). The How it works section above describes this module’s specific weakness; the screen states the intended-secure behavior and exposes the vulnerable action.
3. Exploit. Reach the JS<->native bridge (or the framework/plugin API) from untrusted web content / a cross-origin iframe / a malicious provider, and confirm the privileged native call fires with no main-frame/origin, callback-id, or permission gate in between.
4. Observe the evidence. Trigger the vulnerable action and read the evidence panel - it prints the concrete proof (leaked value, accepted replay, executed payload, or unauthorized result).
5. Contrast with the secure path. Run the module’s secure/hardened action (where provided) and confirm the same attack is rejected - this is what a correct implementation should do.
6. Map it back. Cross-reference the MASTG v2 test(s) MASTG-TEST-0334 for the canonical procedure and remediation.

Tools (optional)

• mitmproxy
• r2frida
• frida

Android

• jadx

iOS

• ipsw
• class-dump

Real-world references

Concrete public disclosures that match this vulnerability class:

• CVE-2026-42184 / GHSA-7gmj-67g7-phm9 (Tauri origin confusion -> local-only IPC)
• CVE-2026-35643 (OpenClaw untrusted WebView origin -> JavascriptInterface injection)