I'm struggling with my web view App, the google play team said that my app is vulnerable to cross-app scripting. I've tried to enable safe browsing (set it to YES) but the warning from google still appears.
Google recommends setting setJavaScriptEnabled to false, but that's not a valid option for me because I use javascript on my webview app.
Does anybody solve these issues?
Ensure that affected activities are not exported
Find any Activities with affected WebViews. If these Activities do not need to take Intents from other apps you can set android:exported=false for the Activities in your Manifest. This ensures that malicious apps cannot send harmful inputs to any WebViews in these activities.
Protect WebViews in exported activities
If you want to set an Activity with an affected WebView as exported then we recommend that you make the following changes:
For more details go to Google Help: Fixing a cross-app scripting vulnerability