Latest WebView Introduces Isolated Renderer Process And In-App Safe Browsing

Latest WebView Introduces Isolated Renderer Process And In-App Safe Browsing

Google released a short review of the changes in the latest version of WebView. Android WebView is a system component for Android allows Android apps to display content from the web directly inside an application.

Starting with Android Lollipop, Google decided to distribute WebView as an independent APK updated from the Play Store every six weeks. The goal is to deliver critical fixes to the users quickly, as the service had seen some serious security conundrums. The newest version of the app brings a couple of important security enhancements as well.

Google will publish Android O later this summer. Alongside the release, WebView will have the renderer running in an isolated process separate from the host app, taking advantage of the isolation between processes provided by Android that has been available for other applications.


WebView will now provide two levels of isolation.

  1. The rendering engine has been split into a separate process. This insulates the host app from bugs or crashes in the renderer process and makes it harder for a malicious website that can exploit the renderer to then exploit the host app.
  2. To further contain it, the renderer process is run within an isolated process sandbox that restricts it to a limited set of resources. For example, the rendering engine cannot write to disk or talk to the network on its own.

    It is also bound to the same seccomp filter as used by Chrome on Android. The seccomp filter reduces the number of system calls the renderer process can access and also restricts the allowed arguments to the system calls.

Finally, the newest version of WebView allows third-party applications to use the Safe Browsing features. According to the blog entry, information or notice warning of possibly malicious websites is displayed over 250 million times a month. With a simple manifest tag, you can enable the Safe Browsing in your app. You can learn which code you need to add by visiting the Android Developers Blog.

The latest version of WebView should soon be available in the Google Play store.

Source: Android Developers Blog

About author

Tomek Kondrat
Tomek Kondrat

In his 30's. Joined XDA in 2011 and the portal in 2013. Senior Moderator and Developer Committee Leader. Android enthusiast that needs to have his devices rooted. Likes football (the real one), travels, TV shows, Kodi, post-rock and good food. Contact: [email protected]

We are reader supported. External links may earn us a commission.