Mobile WebView abuse

When it applies

The app shows web content in a WebView (Android WebView / iOS WKWebView) and either exposes a native JS bridge or loads URLs/content an attacker can influence (deep link, param, MITM'd http).

Why it works

WebViews blur the web/native boundary. A JS bridge (addJavascriptInterface / WKScriptMessageHandler) lets page JavaScript call native code — so XSS or a malicious loaded page can invoke native functionality. Misconfig (setAllowFileAccess, setJavaScriptEnabled, mixed content) widens it to local file theft.