security: harden login WebView — block file/content access and geolocation

The WebView holds the claude.ai session cookie; lock down every path a loaded page could use to reach local files. No effect on the login/SSO flow.
2026-07-10 09:32:20 +00:00
parent 8ae6183901
commit 451f1c8af8
1 changed files with 9 additions and 0 deletions
@@ -75,6 +75,15 @@ class LoginActivity : AppCompatActivity() {
                databaseEnabled = false
                javaScriptCanOpenWindowsAutomatically = false
                setSupportMultipleWindows(false)
+                // Hardening: this WebView holds the claude.ai session, so lock down every path a
+                // page could use to reach the device. None of these affect the login flow.
+                allowFileAccess = false
+                allowContentAccess = false
+                @Suppress("DEPRECATION")
+                allowFileAccessFromFileURLs = false
+                @Suppress("DEPRECATION")
+                allowUniversalAccessFromFileURLs = false
+                setGeolocationEnabled(false)
                // Standard Android Chrome UA — less suspicious than desktop
                userAgentString = "Mozilla/5.0 (Linux; Android 13; Pixel 7) " +
                    "AppleWebKit/537.36 (KHTML, like Gecko) " +