Kotlin Android WebView loads URL from Intent extra
Rule ID: vetkit.kotlin.android.webview-loads-intent-url
A WebView loads a URL taken from the launching Intent (extra or deep-link data). Any app or web link that can start this component can make the WebView open an attacker's page with the app's cookies, JavaScript bridges and file access.
Last updated:
Suite: Security
kotlin
A WebView loads a URL taken from the launching Intent (extra or deep-link data). Any app or web link that can start this component can make the WebView open an attacker's page with the app's cookies, JavaScript bridges and file access.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Parse the value with Uri.parse and only load it when the scheme is https and the host is on an explicit allow-list; otherwise open it in the browser (CustomTabs / ACTION_VIEW) instead of the app's WebView.
References
Source: packages/engine/rules/sast/kotlin.yml.
Related checks
- Android SharedPreferences plaintext secret in Kotlin
- Kotlin Android WebView allowFileAccess enabled
- Kotlin WebView onReceivedSslError calls proceed()
- Kotlin Android WebView addJavascriptInterface exposed
- Kotlin setAllowUniversalAccessFromFileURLs in WebView
- Kotlin Android world-readable or world-writable file mode
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.