Executive brief
A vulnerability in the Android WebView component—a tool used by mobile apps to display web content—could allow malicious websites to bypass security boundaries. If an affected app allows navigation to untrusted websites, a malicious site could execute unauthorized scripts within the app's context, potentially leading to data manipulation or unauthorized actions. Users are protected by updating their Android System WebView via the Google Play Store.
Technical details
A universal cross-site scripting (UXSS) vulnerability exists in the Android WebView system component due to insufficient policy enforcement. The flaw allows a remote attacker to bypass site isolation via a crafted HTML page, specifically enabling cross-origin iframes to execute arbitrary JavaScript in the context of the top-level document. This affects any Android application using WebView versions prior to 83.0.4103.106, including React Native apps using 'react-native-webview'. The issue is resolved by updating the system WebView component to version 83.0.4103.106 or higher; 'react-native-webview' also introduced a mitigation prop in version 11.0.0.
Affected products
- Google WebView < 83.0.4103.106
- React Native Community react-native-webview <= 10.10.2
Timeline
- 2020-06-15: patched: Chrome/WebView 83.0.4103.106 released
- 2020-07-22: advisory: NVD published CVE-2020-6506
- 2020-11-24: patched: react-native-webview version 11.0.0 released with mitigation
References
- https://github.com/react-native-community/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg
- https://github.com/react-native-webview/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg
- https://github.com/react-native-webview/react-native-webview/pull/1747
- https://www.npmjs.com/advisories/1560
- https://security.gentoo.org/glsa/202101-30
- https://security.gentoo.org/glsa/202007-08