CVE-2020-6506

A remote attacker crafts an HTML page containing a cross-origin iframe that, due to insufficient policy enforcement in Android WebView [CWE-863], can execute arbitrary JavaScript in the context of the top-level document. The vulnerability is triggered when a victim using an Android app that relies on Android WebView (version prior to 83.0.4103.106) visits the attacker's page. The researcher describes two proof-of-concept variants: one requiring a tap interaction and another requiring a keypress interaction [ref_id=1]. Because the bug bypasses same-origin policy, the attacker can read or exfiltrate sensitive data from the top-level origin.

The reference write-up does not specify exact source files or functions. The vulnerability resides in Android WebView's cross-origin iframe policy enforcement, introduced around version 76.0.3809.21 Beta / 76.0.3809.89 Stable and fixed in 83.0.4103.106 [ref_id=1]. No patch files are available in the bundle.

The advisory does not include a patch diff, but the fix was delivered in Android WebView version 83.0.4103.106 Stable [ref_id=1]. The vulnerability was tracked as crbug.com/1083819 and was addressed by strengthening policy enforcement in WebView's cross-origin frame handling to prevent injected script execution across origins [ref_id=1]. Users must update Android WebView via the Google Play Store to the patched version; no code-level remediation details are published in the available reference.