How Hybrid Apps Communicate: Mechanisms, Risks, and Secure Practices

Introduction

Hybrid App (mixed‑mode mobile application) is a development model that combines front‑end frameworks with a WebView inside a native app, offering both rich data access and cross‑platform real‑time web development.

Hybrid Implementation

Two common communication methods are described:

1. Google’s JavaScriptInterface

Google provides evaluateJavascript and addJavascriptInterface (exposed as JavascriptInterface) to let the app call JavaScript in the WebView and vice‑versa. The app can invoke webView.evaluateJavascript(...) or load a URL with webView.loadUrl("javascript:test()") to pass parameters.

WebView can expose a class to JavaScript via addJavascriptInterface; annotated methods become callable from the web page.

Utilizing the script parameter in evaluateJavascript executes arbitrary JS code in the web page, enabling data exchange.

Alternatively, webView.loadUrl("javascript:test()") can replace evaluateJavascript.

2. JSBridge Framework

JSBridge is a generic term for extended hybrid communication frameworks. It typically intercepts WebView’s onJsPrompt, onJsAlert, and onJsConfirm callbacks, parses a custom URI passed through window.prompt, and routes the call to a method stored in a HashMap on the app side.

The app validates the calling domain, extracts method and parameters, and executes the corresponding Java method, returning a JSON result to the web page.

Hybrid Communication Risks

Two main risk scenarios:

Malicious WebView loading a crafted URL that triggers unsafe code execution in the app.

Exposed sensitive interfaces in the app that can be invoked from the web side without proper permission checks.

Key risk points include: loading untrusted URLs, exposing sensitive APIs, and insufficient domain validation before invoking privileged methods.

Sample Hybrid App Vulnerability

A vulnerable exported Activity loads a URL constructed from a fixed prefix and a controllable parameter. By using the “@” URL syntax (e.g., https://[email protected]/evil.html), an attacker can force the WebView to load a malicious page.

The page can call an exposed class method without permission checks, causing arbitrary navigation or other malicious actions.

Mitigation Measures

Validate URLs before loading in WebView and allow only trusted domains.

Do not expose sensitive APIs to the web layer.

Perform domain‑based permission checks before executing privileged methods.

Combining these defenses provides depth‑in‑security for Hybrid apps.

Reverse Engineering Focus

Key points for analysis are the two communication directions:

App → WebView: intercept loadUrl and evaluateJavascript.

Web → App: monitor addJavascriptInterface, onJsPrompt, onJsAlert, and related callbacks.

Focusing on these methods typically reveals the data flow and potential vulnerabilities.