A WebView-based browser for testing on Android.

Native Mermaid diagrams in Swift — all 30 types, on Apple, Linux, Android, Windows, Flutter and WebAssembly from one layout core. No JavaScript, no WebView, zero dependencies. - 2389-research/Merma...

Complete Linux platform for .NET MAUI: 50+ controls, GPU-native Skia rendering on OpenGL ES or Vulkan, multi-window, native Wayland and X11, WebView, Blazor Hybrid and HybridWebView on WPE WebKit, Med...

Your website is already working well, compatible with mobile device? Why recreating the wheel, and simply recreate your application around the WebView feature? The idea is simple, use the native Android (or iOS) browser inside your application. It will not fix everything though, but you will be able to reuse your website without rewriting everything from scratch. Another purpose of `WebView` objects is to create an interface to a platform without public API. Indeed, with `WebView` you will have access to a real web browser capabilities, including executing requests on a remote service, storing cookies or executing Javascript script. on Dart/Flutter, the `webview_flutter` package is required. $ flutter pub add webview_flutter Resolving dependencies... Downloading packages... cupertino_icons 1.0.9 (2.0.0 available) material_color_utilities 0.13.0 (0.13.1 available) meta 1.18.3 (1.19.0 available) + plugin_platform_interface 2.1.8 test_api 0.7.12 (0.7.15 available) vector_math 2.4.2 (2.4.3 available) + webview_flutter 4.14.1 + webview_flutter_android 4.14.1 + webview_flutter_platform_interface 2.15.1 + webview_flutter_wkwebview 3.27.0 Changed 5 dependencies! 5 packages have newer versions incompatible with dependency constraints. Try `flutter pub outdated` for more information. `WebView` objects are objects to display web content (usually website) inside an application. This kind of object can be found on Android and on iOS, both implementation offering similar (but not perfectly identical) features. When one `WebView` object is instantiated, it can be used like a browser where a part of its interfaces are exposed to the application. The best way to demonstrate this is to create a WebViewController object. The one presented in the example should do the job for now (with few modification): * The setJavaScriptMode method is called, it can be set to disabled or unrestricted; * The setNavigationDelegate method is called, and a NavigationDelegate object is created. This last one is used to accept or reject the navigation changes. The following callback functions can be configured: * onNavigationRequest: executed to accept/deny navigation; * onPageFinished: executed when the page is fully loaded; * onPageStarted: executed when the page loading started; * onProgress: executed during the page loading progression; * onWebResourceError: executed when an error occurs. * The cacheClear method is called: use the remove the cache from the `WebView`; * The clearLocalStorage method is called: used to clear the local storage from the `WebView`; * The loadRequest method is called: used to load an URL. WebViewController controller({ String target = 'https://authenticationtest.com/simpleFormAuth/' }) { // parse an URL from a string final url = Uri.parse(target); // Return a WebViewController Object with custom callbacks // and parameters return WebViewController() // set the javascript mode to unrestricted (javascript // can be executed) ..setJavaScriptMode(JavaScriptMode.unrestricted) // configure the authorized navigation pattern ..setNavigationDelegate( NavigationDelegate( // a progression gauge can be created if necessary onProgress: (int progress) { print("loading in progress ($progress)..."); }, // when the connection to the page start onPageStarted: (String url) { print("page start to be loaded ($url)."); }, // when the page is totally loaded onPageFinished: (String url) { print("page loaded successfully ($url)."); showCookies(); }, // what to do in case of error onHttpError: (HttpResponseError error) { }, // this callback is used to select what kind of request // is allowed (to which website). onNavigationRequest: (NavigationRequest request) { return NavigationDecision.navigate; })) // when a new object is created, clear up the cache ..clearCache() // clear also the local storage ..clearLocalStorage() // and finally, load the requested url ..loadRequest(url); } With this future object created, it is possible to include it in the flutter tree. To that, one can use a WebViewWidget object, with the previous controller passed as argument. @override Widget build(BuildContext context) { return Scaffold( appBar: AppBar( backgroundColor: Theme.of(context).colorScheme.inversePrimary, title: Text(widget.title), ), body: Center( child: Column( mainAxisAlignment: .center, children: [ Container( child: Row(children: []) ), Expanded(child: WebViewWidget(controller: _controller == null ? controller() : _controller!)) ], ), ), ); } Some variable states can eventually store the reference of the current controller, initialized in the initState() method. This code was defined inside a StatefulWidget Widget. WebViewController? _controller; @override initState() { super.initState(); _controller = controller(); } Here the log output during the loading. Yeah, the `authenticationtest.com` was used to retrieve some session cookies. I/flutter (19018): page start to be loaded (https://authenticationtest.com/simpleFormAuth/). I/flutter (19018): loading in progress (20)... I/flutter (19018): loading in progress (20)... I/flutter (19018): loading in progress (29)... I/flutter (19018): loading in progress (70)... I/flutter (19018): loading in progress (87)... I/flutter (19018): loading in progress (100)... I/flutter (19018): loading in progress (100)... I/flutter (19018): loading in progress (100)... I/flutter (19018): page loaded successfully (https://authenticationtest.com/simpleFormAuth/) The cookies from the `WebView` can also be retrieved (and if needed stored in a local store). This can be achieved by created a new WebViewCookieManager object. After having been successfully instantiated, the cookies can be exported using the getCookies() method. WebViewController? _controller; @override initState() { super.initState(); _controller = controller(); _cookieManager = WebViewCookieManager(); } Future<void> showCookies() async { final currentUrl = await _controller?.currentUrl() ?? ''; final Uri? domain = Uri.tryParse(currentUrl); final cookies = await _cookieManager?.getCookies( domain: domain! ); print(cookies); } Here the log output when some cookies have been received from the website. Those cookies are using the WebViewCookie object, containing 4 fields, name, value, domain and path. The other cookies attributes like `expires` are not available on Android (but it seems they can be found on iOS). I/flutter (19018): [WebViewCookie{name: PHPSESSID, value: 8035d936660419d25f1969de60945682, domain: https://authenticationtest.com/simpleFormAuth/, path: /}] Here a screenshot of the `WebView` from the Android emulator. Few buttons have been added to do tests, like extract the cookies and save same in a permanent store, or switch to another URL. `WebView` is a really interesting feature to bypass some website limitations, especially the one with public API only. Collecting those cookies can then be reused afterward. Some of you would probably ask why I was playing with this package. Well, I needed to fetch some cookies from another website (not the one used here for test), on one of my project. Having access to the cookies will help me to query my target when authenticated. Anyway, here some interesting links if you want to know more: * webview_flutter package from pub.dev; * The official webview_flutter API documentation on pub.dev; * The webview_flutter source code from github; * The official WebView documentation from the Android developer website; * The official mkWebView documentation from the Apple developer website; * cURL HTTP cookies documentation where the cURL cookies format is explained; * The RFC6265 where the `set-cookie` is explained, containing also the official cookies attributes with their specifications; * Starting with Flutter: How to embed a webview by @theotherdevs; * Converting any website into an app: Flutter webview by @franciscodex; * Not Just a WebView: Building a Native Engine on Flutter to Convert Sites to Apps with SDUI by @__2ea5fee000c; * Flutter: Two-way communication between a WebView and a web page by @diamantidis; * Is there a way to show more cookies fields from webview_flutter's WebViewCookieManager on StackOverflow, where I asked a question regarding the extra cookies attributes. As usual, have fun and happy hacking! The stackoverflow user who answered me on my question found a bug in the parser (I missed it), when a value is set to base64, it returns an empty string. In fact, while I was reading the code, I did not see any limits on the size of the key or the value. This should also be tested, a malicious server could eventually overflow an application with badly crafted cookies. This protected could be implemented on the `WebView` (Kotlin) part though and not in the `flutter` interface. Anyway, I will need a way to reproduce (at least) the following bug. Notes from Mozilla documentation: > A `<cookie-name>` can contain any US-ASCII characters except for control characters (ASCII characters 0 up to 31 and ASCII character 127) or separator characters (space, tab and the characters: `(` `)` `<` `>` `@` `,` `;` `:` `\` `"` `/` `[` `]` `?` `=` `{` `}` > > A `<cookie-value>` can optionally be wrapped in double quotes and include any US-ASCII character excluding control characters (ASCII characters 0 up to 31 and ASCII character 127), Whitespace, double quotes, commas, semicolons, and backslashes. > > Encoding: Many implementations perform percent-encoding on cookie values. However, this is not required by the RFC specification. The percent-encoding does help to satisfy the requirements of the characters allowed for `<cookie-value>`. 1. set a cookie with a base64 value (e.g. `dGVzdAo=`) 2. fetch the cookie as `WebCookie`, the value returned is `""`" instead of `"dGVzdAo="` This issue is due to the current implementation of the parser used in the AndrdoiWebViewCookieManager implementation. import 'package:flutter/material.dart'; import 'package:flutter_test/flutter_test.dart'; // code exfiltred from official sources poc(String cookies) { List<dynamic> store = []; for (final String cookie in cookies.split('; ')) { final List<String> cookieValue = cookie.split('='); store.add((cookieValue.first, cookieValue.last)); } return store; } void main() { test("poc", () { print(poc("test=dGVzdAo")); expect(poc("test=dGVzdAo"), ("test", "dGVzdAo")); print(poc("test=dGVzdAo=")); expect(poc("testdGVzdAo="), ("test", "dGVzdAo=")); }); } $ flutter test ... 00:00 +0: poc [(test, dGVzdAo)] 00:01 +0 -1: poc [E] Expected: (String, String):<(test, dGVzdAo)> Actual: [(String, String):(test, dGVzdAo)] package:matcher expect package:flutter_test/src/widget_tester.dart 473:18 expect test/widget_test.dart 25:5 main.<fn> ... Here a quick nginx configuration: events { worker_connections 2000; } http { server { listen 4001; add_header Set-Cookie "test=dGVzdAo=; Path=/"; return 200; } } Thanks to Mahendra Dhakad](https://stackoverflow.com/a/80009898/6782635) on stackoverflow. Cover Image by Paul Skorupskas on Unsplash

Google, Android cihazlar için ekim ayı sistem güncellemelerini yayınladı. Play Hizmetleri, Play Store ve WebView tarafında Wallet, yapay zekâ ve geliştirici odaklı yenilikler geldi.

登山者向け地図アプリ「YAMAP」のAndroid版に脆弱性が明らかとなった。アップデートが呼びかけられている。 ：Security NEXT

国立研究開発法人情報通信研究機構（NICT（エヌアイシーティー）、理事長: 大野 英男）の脅威情報分析チームLETTICE（レティス）は、国内で相次ぐ情報漏えい事案の原因の一つとして、一般に公開されているAndroidアプリを解析し、その情報を悪用してアプリの接続先であるバックエンドサーバを攻撃する手法を特定しました。

Zippy Town 🚗🌙 A tiny toy city with live traffic, baked day/night lighting and a scroll-driven camera, built with #threejs. It started life as an Android live wallpaper in a WebView, then moved to Filament for memory reasons, but the web version lives on 👉 zippy.town @threejs @mrdoob

グラフィックサービスを展開するCanvaは、「Canva Androidアプリ」に関する2件の脆弱性について明らかにした。重要度が「クリティカル」とされる脆弱性も含まれる。 ：Security NEXT

Worst-case frame overrun stayed near 119 ms, versus 589 ms on WebView, for native app publishers. Whether HTML ad sessions get the same option is unresolved.

Worst-case frame overrun stayed near 119 ms, versus 589 ms on WebView, for native app publishers. Whether HTML ad sessions get the same option is unresolved.

An Iranian Android banking and crypto stealer unpacks from a native RC4 packer, targets 81 financial apps through a phishing WebView, intercepts SMS one-time passcodes and resolves its command server from an encrypted pointer in its own manifest that points to a seller’s bio on a legitimate marketplace. This build’s dead drop was still live, so the real C2 (theapi.the-x-services[.]xyz) is recovered end to end. Sample (SHA-256) be165239e4fe899b1f2eedf6459d363bca4fe6856fda87a63ba5d4e5e612e1c9 Package ir.novinarya Loader net.swiftnova.bridge Live C2 theapi.the-x-services[.]xyz Published 2026-10-08 Key findings Two-layer app, native-packed. The installed APK (package ir.novinarya) ships a thin loader shell (net.swiftnova.bridge, 18 KB dex). The stealer itself is a separate Basic4Android payload sealed inside assets/app_cache.db and unpacked on-device by a 29 KB native loader (libuibridge_9203.so) with RC4 (32-byte key, 768-byte drop) then zlib. Asset name, loader name, RC4 key and key transform are re-randomized per build; the unpacked payload is byte-identical across builds. 81 financial targets. It enumerates installed apps (QUERY_ALL_PACKAGES) and matches a hardcoded list of 54 crypto exchanges/wallets and 27 Iranian banking apps. Phishing WebView, not overlays. Credential theft is a WebView loading an operator-controlled page (WebViewURL) with a JavaScript form-grabber over a native “B4A” bridge. The app requests no accessibility and no overlay permission. SMS and notification interception. A broadcast receiver and an encrypted 25-bank regex config (X_BANKS) lift account numbers, balances and OTP codes from bank SMS and notifications. C2 is never a string. The server resolves from an encrypted manifest meta-data value (X_ROUTES, AES-CBC keyed by X_CID) to a URL on basalam.com; the malware reads that profile’s bio and decrypts it to the live, rotating C2. Dead drop on a legitimate marketplace. The operator rotates servers by editing one bio field. The resolver also carries an unused [GITHUB] branch. Live C2 recovered. This build’s dead drop, Basalam profile m6AJm5, was live at analysis time. Its bio decrypts to the active command server hxxp://theapi.the-x-services[.]xyz/. Shared infrastructure, per-build repacking. Five related samples decrypt to two dead-drop accounts: four point at dxoeG7 (now banned) and this one rotated to m6AJm5. The inner stealer dex is identical across all of them, so only the packer and dead-drop config change per build. Technical analysis 01 The native packer and the unpacking chain You will find the payload by reading the bootstrap, not by eyeballing the file tree. The APK’s Application class loads a native library and hands it control before any app code runs:

A developer has created Gu3ssWeak, a deliberately vulnerable Android application designed for practicing mobile application security testing. The app includes intentionally vulnerable components such as WebView and deep link abuse, JavaScript interfaces, XSS, insecure local storage, SQL injection, hardcoded credentials, Frida-based runtime analysis, and vulnerability chaining. The project is intended to provide a realistic APK for practicing tools like JADX, APKTool, ADB, Frida, Burp Suite, and dynamic analysis in a controlled environment, and the developer is seeking feedback and suggestions for additional vulnerabilities.

### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**.

The problem in one word. google. Pale Moon is actually more "compatible" than ever, but the google monoculture makes compatibility an ever increasing, ever-changing, moving goal post that's entirely within googles control. googles near-monopoly, and definitely monoculture is performing vertical integration of virtually all internet points of access. From smartphone (pixel) to smartphone OS (android) to smartphone browser (chromium webview) to desktop browser (chromium) to DNS (8.8.8.8, etc) to captcha (recaptcha) and CDN (firebase) to internet/browser "standards" (WHATWG) to top 10 most used site frameworks (using V8 JS) to third party site content (gfonts, gstatic, tag manager, ads, etc), to sites themselves (google search, virustotal, youtube, etc) or apps/programs (flutter, tauri, electron, CEF, etc). That's not even mentioning their funding of "competitors" (apple/firefox "search" deals) or how Safari and Firefox (and hence reskins of those) directly lift and incorporate google tech like WideWine, Safe Browsing list, Web RTC, Web Extensions, etc, to keep up themselves. chromium also being a fork of web kit. Everything google do, like rapid release cycles constantly pushing new or re-writing "old" API's, or FLoC/Topics/WEI/PerformanceObserver, is totally geared towards pushing out competitors or have them fall in line. fb.com is a part of the incestuous "you scratch my back I scratch yours" Big Tech/GAFAM/FAANG (google, microsoft, amazon, facebook, apple), github.com is owned by microsoft, thefreedictionary.com uses google ads, vk.ru & m.vk.ru are geared towards google android/apple iOS smartphones, youtube.com is google, x.com I can't say, because I use a fronted and have no issues (although sometimes I have to right-click, copy video location and paste and go in the URL bar to watch), reddit.com is a known partner with google, archive.org I have no issues with, aliexpress.com looks fine to me. Maybe you need to go over your setup. Version, addons, preference changes, etc. > BTW, is there any add-on which could be used to fire a backup browser of choice when current page fails with Pale Moon ? Yes. I use https://addons.palemoon.org/addon/openwithieedge/ * * *