2025-03-26 11:57:39 +01:00
|
|
|
Exposing the Android file system to WebViews is security-sensitive.
|
2021-10-12 15:38:05 +02:00
|
|
|
|
2025-03-26 11:57:39 +01:00
|
|
|
Granting file access to WebViews, particularly through the `file://` scheme, introduces a risk of local file inclusion
|
|
|
|
|
vulnerabilities. The severity of this risk depends heavily on the specific `WebSettings` configured. Overly permissive
|
|
|
|
|
settings can allow malicious scripts to access a wide range of local files, potentially exposing sensitive data such as
|
|
|
|
|
Personally Identifiable Information (PII) or private application data, leading to data breaches and other security
|
|
|
|
|
compromises.
|
