# Unvalidated URL scheme into privileged WebView

Deep link or stored URL reaching a WebView without rejecting javascript, file, data, or internal schemes

_Area: Mobile app security. Seen in 3 disclosed reports; 2 confirmed bounties: $3,500 and $4,000; latest 2023-06-22. Updated 2026-10-24._

## How it works
A WebView trusts whatever URL it is handed. When an app passes an attacker-influenced URL (from a deep link, a stored feed entry, or a rendered attachment) into a WebView without checking its scheme, the WebView treats it as content from a trusted origin. The broken assumption is that "a URL is just a link." In practice a `javascript:` URL runs script in the WebView's origin, and script running there can read the app sandbox via `file://` requests [E2](https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-lovestory-from-closed-as-informative-to-xx00-usd-in-yahoo-ios-mail-app.md). The app's own privilege (its origin, its file access, its cookies) becomes the attacker's.

## Where it shows up
- Deep link handlers that `Uri.parse` a parameter and load it directly into a WebView [E1](https://bugbountylibrary.com/r/blog%3Aoffsec-space-posts-airtel-vulnerabilities.md)
- WebView settings enabling JavaScript, file access, and geolocation together [E1](https://bugbountylibrary.com/r/blog%3Aoffsec-space-posts-airtel-vulnerabilities.md)
- Features rendering user-supplied links (RSS feeds, article lists) as tappable hrefs with no scheme allowlist [E3](https://bugbountylibrary.com/r/h1%3A1184379.md)
- Attachment renderers that treat SVG/XML as HTML inside a WebView [E2](https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-lovestory-from-closed-as-informative-to-xx00-usd-in-yahoo-ios-mail-app.md)
- Any code path where a URL from outside the app reaches `loadUrl`/`loadRequest` without a scheme check

## How to review
Trace every URL that reaches a WebView back to its source. The invariant: only `https` (or an explicit allowlist of schemes and hosts) may be loaded, and the check must happen at the load site, not upstream. Confirm `javascript:`, `data:`, `file:`, and internal/custom schemes are rejected. Check WebView settings: JavaScript and file access should be off unless required, and never combined with untrusted content. For link rendering, verify hrefs are validated by scheme before display.

## Variants seen
- Deep link parameter loaded into a JavaScript- and file-enabled WebView [E1](https://bugbountylibrary.com/r/blog%3Aoffsec-space-posts-airtel-vulnerabilities.md)
- SVG/XML attachment rendered as HTML, executing script that reads sandbox files via `file://` XHR [E2](https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-lovestory-from-closed-as-informative-to-xx00-usd-in-yahoo-ios-mail-app.md)
- `javascript:` URLs accepted in custom RSS feed links, running on a privileged localhost origin [E3](https://bugbountylibrary.com/r/h1%3A1184379.md)

## Impact and severity
Led to theft of files, location, cookies, contacts, and email content [E1](https://bugbountylibrary.com/r/blog%3Aoffsec-space-posts-airtel-vulnerabilities.md)[E2](https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-lovestory-from-closed-as-informative-to-xx00-usd-in-yahoo-ios-mail-app.md). Severity is high: the WebView inherits the app's origin and sandbox access. It worsens when JavaScript, file access, and geolocation are all enabled [E1](https://bugbountylibrary.com/r/blog%3Aoffsec-space-posts-airtel-vulnerabilities.md), and when the WebView sits on a privileged internal origin [E3](https://bugbountylibrary.com/r/h1%3A1184379.md). Note E1 also bundles a separate Play Core path-traversal flaw; attribute code execution to that half, not the WebView.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aoffsec-space-posts-airtel-vulnerabilities.md
- E2: https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-lovestory-from-closed-as-informative-to-xx00-usd-in-yahoo-ios-mail-app.md
- E3: https://bugbountylibrary.com/r/h1%3A1184379.md