Bypassing network restriction using webview

User2288

Hello.

I have realized a number of potentially problematic issues which I want to have an open conversation with you about to find out if there is merit to these concerns.

As you know, system web view (SWV - vanadium) is available to all apps and can't be disabled. This means that an app can call the SWV and either load a remote script to fingerprint the browser or load a local script in SWV and get a fingerprint of SWV. My guess is that it can do this in the background without the user even seeing anything (while app is in use).

If the apps has no network access, Can the app use SWV to "send" data (requests with parameters, xhr, etc)?

I tried testing this using obtanium. I tried blocking SWV from internet access in GoS, But I noticed SWV already had no network permission. I set network permission to on, and then off to be sure. Then I tested the app. the first click on an item would not load its GitHub page, but the second try on same item would. So I had gained access to the page through SWV even though SWV was given no network access.

Just to be safe, I erased all cache from SWV, and also erased all web history and cache from vanadium as well and blocked vanadium from internet as well. So now both vanadium and SWV are network blocked (using system setting), while obtanuim has internet access. I then completely disabled vanadium in app settings. Then I loaded obtanium and tried again, I was able to load GitHub pages in obtanium again.

Next I erased all cache for SWV again and I disabled network access for obtanium too. Pages couldn't load this time. SWV seemed to still be loading in the background but was getting a "no internet" error page and I was getting "address not resolved" error in foreground in obtanium.

This is not a very decisive test as obtanium may not be the best tool for testing this. But this test demonstrated that the network block for obtanium also blocked SWV access. However, I am not so convinced that this can be trusted.

There is a few issues here:

Does blocking network access "reliably" prevent an app from accessing the net through webview?
If I need an apps to HAVE internet access but not be able to access SWV there is no way to achieve this. SWV can't be disabled.
This is potentially a serious concern for profiles that have Google components installed (GSF, Photos, Google Camera), because even if they have internet blocked they may be able to communicate to the internet using webview. and could submit sensitive data (facial biometric data from photos, SWV fingerprint) to the internet. Or can they?

What is your understanding on this issue?

abcZ

1) You can't access network without network permission. This has nothing to do with webview.
2) There is nothing to gain by this, don't waste your time.
3) See (1).

ve3jlg

abcZ You can't access network

I'm trying to understand. Which AOSP and GrapheneOS software component(s) do you mean by "You" here?

abcZ

ve3jlg The answer is evident when you don't cut off most of it.

Graphite

From what I understand, System Web View is only a Rendering engine. It doesn't fetch files from the internet directly. The app that calls it (Obtanium in your case), uses it's own network permission to fetch the web resources, then calls SWV to render the page locally. Sure, JS can be run in the renderer, but not sure of any additional risk there. Obtainium is responsible to prevent unwanted code execution. I believe it scrapes websites like Github, but doesn't attempt to run any javascript.

Graphite

I don't have Obtainium, but I tried another app that uses webview. It failed to login when SWV network is denied.

However, if I login, then disable network access, the app functions normally.
It is possible that some apps, such as those reliant on JS code execution in the renderer itself (during login), it could need webview to have network permissions. So it is up to the applicaton using webview. Still don't think the possibility of fingerprinting is a big risk though.

User2288

bump.

I'm still interested and wondering if GOS team has anything to say about this?

The questions are:

can apps that are network blocked access the internet through webview?
Would it be possible to to disable webview entirely (by user choice) to prevent all access to webview (by apps) to prevent vanadium fingerprinting. (I know its not possible right now, no option in GOS. I'm wondering if is it technically possible and if it would prevent fingerprinting).

There are some apps (not privacy respecting) I have to give internet access to. It would be good if we could block them all access to vanadium fingerprint.

Graphite

User2288 can apps that are network blocked access the internet through webview?

Ok, so I tested this definitively. I used tasker to build an app. The app calls WebView to fetch a webpage I control (so I can see all requests).
When the app does not have network permissions, it does not work.
I changed the app to fetch only a local html file using WebView, then there's an inline script to redirect to the webpage. If WebView were using it's own network permissions, I'd expect this redirect to work. But it fails when the app is denied network permissions. So maybe it's inherited.