4 ms·
Sure, malware can ship its own browser engine but it can not attest authenticity to the server. The proposal doesn't limit the Android WebView in any way.
by nolist_policy 3y ago
Sure, malware can ship its own browser engine but it can not attest authenticity to the server.
The proposal doesn't limit the Android WebView in any way.
- rezonant 3y agoYes, but that's not sufficient. If, say, YouTube would like to prevent an Android game from running an invisible and silent webview watching videos on YouTube.com (because some ethically challenged YouTubers paid them to help juice their view counts), YouTube could use the new web view integrity API to validate that webview, but if the developer ships an engine inside of that game and uses that instead of using the WebView, then YouTube cannot tell that its not just a third party browser. So unless they are going to block all third party browsers, which they can't actually do because the browser could be configured to emulate Chrome, and Chrome doesn't actual implement any kind of attestation... So there's already a way to bypass what they are trying to do.