How severe is webview addjavascriptinterface exposes native code to js?

Shield rates this high (CVSS 8.8), classified as CWE-749.

Rules / Kotlin

SHIELD-KOTLIN-005

WebView addJavascriptInterface exposes native code to JS

highKotlinCWE-749CVSS 8.8

WebView.addJavascriptInterface bridges JavaScript to native objects and can allow remote code execution on older APIs.

Avoid addJavascriptInterface for untrusted content; if required, target API 17+ and annotate exposed methods with @JavascriptInterface.

Vulnerable — Shield flags thisWebAct.kt

fun setup(webView: WebView) {
    webView.addJavascriptInterface(JsBridge(), "Android")
    webView.loadUrl("https://example.com/app")
}

Fixed — scans cleanWebAct.kt

fun setup(webView: WebView) {
    webView.webViewClient = WebViewClient()
    webView.loadUrl("https://example.com/app")
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-005, the fixed one does not.