Native / WebView Bridge (JS <-> Native)

The WebView<->native JavaScript bridge as its own cross-platform trust boundary (Android addJavascriptInterface / WebMessageListener; iOS WKUserContentController / WKScriptMessageHandler). Web content - including a cross-origin iframe - reaches the bridge and, without main-frame/origin validation, callback-id validation, or a permission gate, invokes privileged native functionality. Also covers framework/plugin boundaries (Flutter / React Native / Cordova / Capacitor) where the dangerous code lives in the plugin layer behind an innocent-looking app API. Modelled on 2024-2026 disclosures: Home Assistant Companion (CVE-2026-44698 iframe->bridge token theft; GHSA NFC/QR silent automation; GHSA exported-receiver location spoof), Cordova InAppBrowser (CVE-2026-47430 callback-id injection), and Flutter file_picker (CVE-2026-38093 provider-metadata path traversal).

15 vulnerabilities. OWASP Mobile: M4

Vulnerability	ID	Platform	Difficulty	OWASP	MASVS	MASWE	MASTG (v2)	CWE
WebView Safe Browsing Disabled	`webview_safe_browsing_disabled`	Android	EASY	M8	MASVS-PLATFORM-2	MASWE-0035	MASTG-TEST-0399	CWE-1188 CWE-693 CWE-829
Embedded Mini-App Secret Exposure	`embedded_miniapp_secret_exposure`	AndroidiOS	MEDIUM	M9	MASVS-STORAGE-1 MASVS-PLATFORM-2	MASWE-0001	MASTG-TEST-0320	CWE-312 CWE-522 CWE-294
Exported BroadcastReceiver Data Spoofing	`exported_broadcast_receiver_spoof`	Android	MEDIUM	M4	MASVS-PLATFORM-1	MASWE-0032	MASTG-TEST-0366	CWE-925 CWE-862 CWE-346
QR / NFC Scan -> Privileged Action Without Confirmation	`qr_nfc_to_privileged_action`	AndroidiOS	MEDIUM	M4	MASVS-PLATFORM-1 MASVS-PLATFORM-3	MASWE-0032	-	CWE-306 CWE-862 CWE-346
WebView Cleartext / Mixed-Content Transport Downgrade	`webview_cleartext_mixed_content_downgrade`	AndroidiOS	MEDIUM	M5	MASVS-NETWORK-1 MASVS-PLATFORM-2	MASWE-0026 MASWE-0035	MASTG-TEST-0235 MASTG-TEST-0237	CWE-319 CWE-311 CWE-829
WebView Remote Debugging Enabled	`webview_remote_debugging_enabled`	Android	MEDIUM	M8	MASVS-RESILIENCE-1 MASVS-PLATFORM-2	MASWE-0063	MASTG-TEST-0227	CWE-489 CWE-215 CWE-200
Cross-Origin Iframe -> Native Bridge (No Main-Frame/Origin Check)	`crossorigin_iframe_to_native_bridge`	AndroidiOS	HARD	M4	MASVS-PLATFORM-2 MASVS-CODE-4	MASWE-0033	MASTG-TEST-0334 MASTG-TEST-0376	CWE-346 CWE-1021 CWE-668
JS Bridge Callback-ID Injection	`js_bridge_callback_id_injection`	AndroidiOS	HARD	M4	MASVS-PLATFORM-2 MASVS-CODE-4	MASWE-0033	MASTG-TEST-0334	CWE-345 CWE-441 CWE-20
JS Bridge Exposes a Privileged Native API	`js_bridge_exposes_privileged_api`	AndroidiOS	HARD	M4	MASVS-PLATFORM-2 MASVS-AUTH-1	MASWE-0033	MASTG-TEST-0334	CWE-749 CWE-862 CWE-926
Provider-Controlled Metadata -> Plugin Filesystem Traversal	`provider_metadata_to_filesystem_traversal`	Android	HARD	M4	MASVS-PLATFORM-1 MASVS-STORAGE-2	MASWE-0032	-	CWE-22 CWE-73 CWE-20
Shared WebView Mini-App Isolation Failure (Cross-Tenant Cookies)	`shared_webview_miniapp_isolation`	AndroidiOS	HARD	M4	MASVS-PLATFORM-2 MASVS-STORAGE-2	MASWE-0034	-	CWE-346 CWE-668 CWE-200
WebView JS Injection + SSL-Validation Bypass	`webview_js_injection_ssl_bypass`	AndroidiOS	HARD	M5	MASVS-NETWORK-1 MASVS-PLATFORM-2	MASWE-0027 MASWE-0035	MASTG-TEST-0284	CWE-295 CWE-79 CWE-749
WebView Origin Confusion -> Local-Only IPC	`webview_origin_confusion_ipc`	AndroidiOS	HARD	M4	MASVS-PLATFORM-2 MASVS-CODE-4	MASWE-0034	MASTG-TEST-0334	CWE-346 CWE-863 CWE-441
WebView SOP / CSP Disabled (Cross-Origin & Inline Script)	`webview_sop_csp_disabled`	AndroidiOS	HARD	M4	MASVS-PLATFORM-2 MASVS-CODE-4	MASWE-0034	MASTG-TEST-0335 MASTG-TEST-0333	CWE-346 CWE-79 CWE-829
WebView URL-Loading Policy Confusion	`webview_url_loading_policy_confusion`	AndroidiOS	HARD	M4	MASVS-PLATFORM-2 MASVS-CODE-4	MASWE-0035	MASTG-TEST-0332 MASTG-TEST-0398	CWE-20 CWE-441 CWE-939