• Close
  • Back to search

    Android Browser and WebView addJavascriptInterface Code Execution

    This module exploits a privilege escalation issue in Android < 4.2's WebView component that arises when untrusted Javascript code is executed by a WebView that has one or more Interfaces added to it. The untrusted Javascript code can call into the Java Reflection APIs exposed by the Interface and execute arbitrary commands. Some distributions of the Android Browser app have an addJavascriptInterface call tacked on, and thus are vulnerable to RCE. The Browser app in the Google APIs 4.1.2 release of Android is known to be vulnerable. A secondary attack vector involves the WebViews embedded inside a large number of Android applications. Ad integrations are perhaps the worst offender here. If you can MITM the WebView's HTTP connection, or if you can get a persistent XSS into the page displayed in the WebView, then you can inject the html/js served by this module and get a shell. Note: Adding a .js to the URL will return plain javascript (no HTML markup).

    Free Metasploit Download

    Get your copy of the world's leading penetration testing tool

     Download Now

    Module Name



    • jduck <jduck [at] metasploit.com>
    • joev <joev [at] metasploit.com>



    • Automatic


    • android
    • linux


    • dalvik
    • x86
    • armle
    • mipsle



    Module Options

    To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

    msf > use exploit/android/browser/webview_addjavascriptinterface msf exploit(webview_addjavascriptinterface) > show targets ...targets... msf exploit(webview_addjavascriptinterface) > set TARGET <target-id> msf exploit(webview_addjavascriptinterface) > show options ...show and set options... msf exploit(webview_addjavascriptinterface) > exploit

    Related Vulnerabilities