30

In my app, I am currently using a web view to display some content. Then, I use Javascript injection to quickly fill out the form for the user.

The only issue is, Webviews are incredibly slow compared to Chrome Custom tabs. Is it possible to inject Javascript code into these custom tabs?

For example, here is some code I currently use: 

myWebView.loadUrl("javascript:document.getElementById('join_first_name').value='" + name + "';void(0); ");
Ashishkumar Singh
  • 3,580
  • 1
  • 23
  • 41
alex23434
  • 389
  • 5
  • 12

4 Answers4

33

No; that would be a critical security hole.

Since custom tabs use cookies, settings, and password managers from the user's real Chrome instance, you cannot control them at all.

SLaks
  • 868,454
  • 176
  • 1,908
  • 1,964
11

Chrome prohibits you from doing any of that. If this were allowed then it would be a major security flaw since you can modify the page within the app.

Suppose you have an app that has a facebook sign in. If this were possible, one could also steal someone's login credentials.

With Chrome Custom tabs, you don't have much control over the content that is served. You should probably try an alternative, like passing the first name as a URL parameter and then write a script on that page to read the parameter and fill the form out.

Raymond
  • 396
  • 4
  • 21
3

you need to do it like that by using data:text/html, as prefix for your script

Try that in your browser tab 

data:text/html,<script>alert("hello")</script>

it will fire the javascript and alert , and as well you can print some in html from url

so i guess you need just to open the tab with the script

 String suffix = "data:text/html,"
 String script = "<script>document.getElementById('join_first_name').value='" + name + "';</script>"
 String url = suffix + script
 myWebView.loadUrl(url);

It's browser behaviour in desktop and mobile

I haven't try it in WebView.loadUrl and actually still if it's done by WebView.loadUrl it will be a security hole

mooga
  • 3,136
  • 4
  • 23
  • 38
2

There's supposed to be no way to inject Javascript to Chrome web browser. If you can execute the Javascript queries to chrome via some third party apps, thereby you can read all the cookies, clear every sessions, and whatever the javascript is capable of. Which is really a huge security flaw.

What you can do is to load your URL in webview and execute the javascripts there. That's the only possible i've ever heard of. This is the same technique used for EPUB documents, where we load the complete HTML content in webview then we execute external Javascript queries into that view, so you can modify the HTML, CSS attributes.

Manoj Perumarath
  • 9,337
  • 8
  • 56
  • 77