Android WebView Security

JavaScript:
Enabling JavaScript in a WebView can increase the attack surface.
The security impact depends on the content loaded by the WebView
and how it is exposed.

JavaScript interfaces:
JavaScript interfaces can expose native Android functionality to
web content. Insecurely exposed interfaces may allow untrusted
content to invoke sensitive native functionality.

User-controlled URLs:
A WebView that loads user-controlled URLs should be reviewed because
untrusted web content may interact with enabled WebView capabilities.

File access:
WebView file access can increase exposure when untrusted content
can access local resources.

Runtime evidence:
Successful JavaScript execution, exposed interfaces, bridge calls,
and local file access provide stronger evidence than static indicators
alone.

Important:
Using a WebView or enabling JavaScript does not automatically mean
that a vulnerability exists.