Android WebView Safe Browsing

Android WebView has supported core Safe Browsing features since 2017.

What is Safe Browsing?

See the relevant Chromium classes in //components/safe_browsing/.

For info on the feature, see https://safebrowsing.google.com/.

Building your own WebView

Depending on which Safe Browsing features you need to test, you may need to build WebView from an upstream (public) or a downstream (internal) build target.

Upstream

Upstream (public) WebView targets support a limited form of Safe Browsing. WebView only supports blocking hard-coded URLs, but this is sufficient if all you need is to create an interstitial for testing. You can build and install system_webview_apk (see quick start).

Downstream

The WebView we ship to users is based on downstream (private) build targets. If you need to test the GMS-based implementation which we use to block real malware, you need to build one of the downstream targets. See Google-internal instructions.

Opt-in/consent/requirements

Google Play Services

Note: this is only relevant for the GMS-based implementation in downstream WebView targets.

If Google Play Services (AKA GMSCore) is uninstalled, disabled, or out-of-date, WebView cannot perform Safe Browsing checks (with the exception of hard-coded URLs). Before trying Safe Browsing locally, make sure this is up-to-date:

$ adb shell am start -a "android.intent.action.VIEW" -d "market://details?id=com.google.android.gms"
# Then, manually update GMS in the UI.

If Google Play Services is installed, the user must opt into Google Play Protect's “Verify Apps” setting: Settings > Google > Security > Google Play Protect > Scan device for security threats.

Application opt-in

Safe Browsing is enabled by default, but applications can explicitly disable it with a manifest tag:

<manifest>
    <application>
        <meta-data android:name="android.webkit.WebView.EnableSafeBrowsing"
                   android:value="false" />
        ...
    </application>
</manifest>

Hard-coded URLs

WebView supports Safe Browsing checks (for testing purposes) on hard-coded WebUI URLs defined in //components/safe_browsing/core/common/web_ui_constants.cc (ex. chrome://safe-browsing/match?type=malware).

These URLs don't show meaningful content, but will trigger an interstitial when trying to navigate to them. WebView relies on these URLs in our CTS tests, so they must never change (but more URLs may be added).

Differences in support and types of interstitials

See this page.

Testing Safe Browsing

Automated tests live here.

You can manually test Safe Browsing with the WebView Shell. Navigate to one of the hard-coded URLs mentioned above.

To test more complex scenarios and WebView's Safe Browsing APIs, please try out the open source WebView demo app.

Note: if testing Safe Browsing manually, make sure to update GMS and opt-into Google Play Protect.

Supporting new threat types

As Chrome supports more threat types, so can WebView. The steps are:

  1. Create quiet interstitial resources for the new threat type (example CL).
  2. Add IDs to their respective allowlist files: resources and strings (general docs, example CL).
  3. Add the new threat type to our list of threats (example CL).
  4. Add a hard-coded URL (example CL).
  5. Write integration tests (example CL).
  6. Add a new threat type constant to the Android SDK (constants are defined in WebViewClient.java, please consult a WebView team member before this step). The new threat type constant should only be used when the application targets the new Android SDK: use SAFE_BROWSING_THREAT_UNKNOWN for apps with older targetSdkVersions (see http://crbug.com/887186#c15 and http://b/117470538).