Data on WebView data security and privacy models

[RupertBenWiser]

This could be helpful for people designing new features on the web. We can have compat data on "who" has access to "what" data, and "why" for the various WebView providers.

[abhijeetk]

WebView can adopt some of the security and privacy features found in iframes or fenceframes, such as the allow-same-origin attribute. If you're documenting this somewhere, I'd be interested in taking a look.

[RupertBenWiser]

Thanks for the ideas at @abhijeetk - step one from my perspective is capturing what the current state of WebViews is today to get a baseline. But I definitely agree that as a next step, it would be great to then identify opportunities into how new privacy standards could benefit WebViews.

[sohomdatta1]

Not sure if this will be useful to y'all, but wanted to mention that I, alongside folks with other folks at the WSPR Lab at NCState, TUC, and UIC, recently (last year) conducted a study into Android privacy inside Android webviews, while our project focused specifically on the leakage of native data into webviews, one of the other outputs was a dataset of every single API executed by a set of phones across 1 month obtained using a custom modified version of VisibleV8. Given that a lot of the issues in this project (including this one) seemed focused on gathering data on use cases/looking at API usages, I wanted to mention the dataset and our project in case y'all wanted to take a look :)