Haxoris Wiki

WebView Debugging Enabled

How WebView Debugging Enabled works

Enabling setWebContentsDebuggingEnabled(true) in production allows any attached debugger (e.g., Chrome DevTools) to inspect and manipulate WebView contents, cookies, and local storage.

WebView Debugging Enabled in practice

Detect Debugging

rg -n "setWebContentsDebuggingEnabled\(true\)" src out

Inspect via Chrome

Open chrome://inspect and attach to the app’s WebView. If you can read/modify content, debugging is enabled.

How to fix and prevent WebView Debugging Enabled

  1. Disable in release
    • Guard WebView debugging behind build flags; ensure release builds set it to false.
  2. Content hardening
    • Limit sensitive content in WebViews; use secure cookie flags and storage.
  3. CI enforcement
    • Add static checks to fail builds that enable debugging in release.

Last updated

References