Skip to content
AI Security

Interview question · Mobile Application Security

What are the security risks of WebViews in mobile apps, especially with JavaScript bridges, and how do you design one safely?

A WebView puts a browser inside your app, without the browser's address bar, and often with a bridge to native code. XSS in that page is no longer 'just XSS'.

hardNewPreparation tags: Google, Apple, MetaUpdated Nov 2026

A WebView puts a browser inside your app, without the browser's address bar, and often with a bridge to native code. XSS in that page is no longer 'just XSS'.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A banking app uses a WebView to show help pages and some account screens loaded from its own website.

  1. Where does WebView risk come from?
  2. Why is a JavaScript bridge dangerous?
  3. How should navigation be restricted?
  4. Which settings should be off?
  5. Should account screens use WebViews at all?
  6. How would you secure the WebView use?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackBeyond storage, where does sensitive data leak from a mobile app, and how do you find and close each leak?Next in this trackThreat-model a mobile banking app. Which controls belong on the device, and which must stay on the server?Next in this trackShould a mobile app pin certificates? If so, what do you pin, and how do you rotate keys without breaking the fleet?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.