# CVE-2020-6506: Google Android WebView Universal Cross-site Scripting

Source: https://junglewise.ai/threats/cve-2020-6506-google-android-webview-universal-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-10-02. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2020-6506 · Severity: low · CVSS 3.1 · Published 2020-10-02

A vulnerability in the Android WebView component—a tool used by mobile apps to display web content—could allow malicious websites to bypass security boundaries. If an affected app allows navigation to untrusted websites, a malicious site could execute unauthorized scripts within the app's context, potentially leading to data manipulation or unauthorized actions. Users are protected by updating their Android System WebView via the Google Play Store.

Technologies: [Google WebView](https://junglewise.ai/threats/technologies/webview). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-6506 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-6506 being exploited in the wild.

**How severe is CVE-2020-6506?** Low severity, with a CVSS score of 3.1, published 2 October 2020.

**Which products and versions are affected?** Google WebView < 83.0.4103.106; react-native-webview (npm) SEMVER:introduced=0,fixed=11.0.0.

**Is there a fix for CVE-2020-6506?** Yes. react-native-webview (npm): upgrade to 11.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-6506 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2020-6506?** Check whether you run Google WebView or react-native-webview (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- react-native-webview (npm): upgrade to 11.0.0 or later

  ```sh
  npm install react-native-webview@11.0.0
  ```


## Technical details

A universal cross-site scripting (UXSS) vulnerability exists in the Android WebView system component due to insufficient policy enforcement. The flaw allows a remote attacker to bypass site isolation via a crafted HTML page, specifically enabling cross-origin iframes to execute arbitrary JavaScript in the context of the top-level document. This affects any Android application using WebView versions prior to 83.0.4103.106, including React Native apps using 'react-native-webview'. The issue is resolved by updating the system WebView component to version 83.0.4103.106 or higher; 'react-native-webview' also introduced a mitigation prop in version 11.0.0.

## Affected products

- Google WebView < 83.0.4103.106
- React Native Community react-native-webview <= 10.10.2

## Identifiers

- CVE-2020-6506
- GHSA-36j3-xxf7-4pqg

## Timeline

- 2020-06-15: patched: Chrome/WebView 83.0.4103.106 released
- 2020-07-22: advisory: NVD published CVE-2020-6506
- 2020-11-24: patched: react-native-webview version 11.0.0 released with mitigation

## References

- [https://github.com/react-native-community/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg](https://github.com/react-native-community/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg)
- [https://github.com/react-native-webview/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg](https://github.com/react-native-webview/react-native-webview/security/advisories/GHSA-36j3-xxf7-4pqg)
- [https://github.com/react-native-webview/react-native-webview/pull/1747](https://github.com/react-native-webview/react-native-webview/pull/1747)
- [https://www.npmjs.com/advisories/1560](https://www.npmjs.com/advisories/1560)
- [https://security.gentoo.org/glsa/202101-30](https://security.gentoo.org/glsa/202101-30)
- [https://security.gentoo.org/glsa/202007-08](https://security.gentoo.org/glsa/202007-08)

## Related threats

- [Google Chrome WebView privilege escalation on Android](https://junglewise.ai/threats/cve-2026-12448-google-chrome-webview-privilege-escalation-on-android)
- [Google Chrome WebView sandbox escape on Android](https://junglewise.ai/threats/cve-2026-12438-google-chrome-webview-sandbox-escape-on-android)
- [Google Chrome WebView privilege escalation on Android](https://junglewise.ai/threats/cve-2026-11295-google-chrome-webview-privilege-escalation-on-android)
- [Google Chrome WebView integer overflow in Android](https://junglewise.ai/threats/cve-2026-11290-google-chrome-webview-integer-overflow-in-android)
- [Google Chrome WebView insufficient policy enforcement on Android](https://junglewise.ai/threats/cve-2026-11178-google-chrome-webview-insufficient-policy-enforcement-on-android)