Universal XSS in Android WebView

Overview

A universal cross-site scripting (UXSS) vulnerability, CVE-2020-6506 (https://crbug.com/1083819), has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps which use a react-native-webview that allows navigation to arbitrary URLs, and when that app runs on systems with an Android WebView version prior to 83.0.4103.106.

Recommendation

react-native-webview 11.0.0+ has introduced a new prop to mitigate this issue. Updating to a later version is recommended.

References

• https://alesandroortiz.com/articles/uxss-android-webview-cve-2020-6506/
• https://github.com/react-native-webview/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg
• GitHub Advisory