WebView JavaScript execution unrestricted

ID

dart.platform.webview_javascript_enabled

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Platform

Language

Dart

Description

A Flutter WebView is configured with JavaScript execution in unrestricted mode (JavaScriptMode.unrestricted in webview_flutter, or javaScriptEnabled: true / javaScriptCanOpenWindowsAutomatically: true in flutter_inappwebview). Combined with any untrusted HTML / URL load, this is a direct XSS vector with full WebView privileges.

Rationale

WebView with JavaScript enabled lets the rendered page run arbitrary scripts in the WebView origin. If the page also has access to a JavaScriptChannel / addJavaScriptHandler bridge, the script can invoke Dart callbacks — escalating from web-context XSS to host- application privilege.

Even without channels, JavaScript in a WebView can:

  • Read cookies, sessionStorage, localStorage for that origin (session hijacking, account takeover).

  • Trigger navigation to phishing pages styled identically to the app.

  • Exfiltrate the DOM (forms, secrets the user typed) to an attacker endpoint via fetch / XMLHttpRequest.

  • Read the page’s CSP and adjust its payload accordingly.

Disable JavaScript by default; enable only on WebViews that render trusted, app-controlled HTML/URLs and that have other XSS controls in place (strict CSP, sanitization at the source, no user input injected into the page).

The following code illustrates a vulnerable pattern detected by this rule:

class JsEnabled {
  WebViewController v4() {
    final c = WebViewController();
    // VULNERABLE: WebView JavaScript execution unrestricted
    c.setJavaScriptMode(JavaScriptMode.unrestricted);
    return c;
  }
}

Remediation

Set JavaScript to disabled / opt-in, and only enable it for WebViews that load fully-trusted content.

// Vulnerable
controller.setJavaScriptMode(JavaScriptMode.unrestricted);
InAppWebViewSettings(javaScriptEnabled: true);

// Fixed
controller.setJavaScriptMode(JavaScriptMode.disabled);
InAppWebViewSettings(javaScriptEnabled: false);

// If JS is required, render only known-trusted HTML and avoid
// exposing JavaScriptChannel handlers that take action on host state.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved