Reported by security researcher (Kaushik).
Issue
BrowserViewController's WKNavigationDelegate implements only request-side policy (decidePolicyFor navigationAction, always .allow). There is no decidePolicyFor navigationResponse, so WKWebView's default renders any renderable MIME type inline — including text/html served with Content-Disposition: attachment, which standard browsers download or refuse to render.
Impact
An HTML file uploaded to a trusted file-hosting domain (e.g. Google Drive, served as attachment) renders inline in the in-app browser under that trusted origin — enabling convincing phishing (the page can trigger wallet connect/sign prompts while showing a trusted domain) and access to origin-bound state within the app's webview data store.
Fix
Implement decidePolicyFor navigationResponse: .cancel when the response carries Content-Disposition: attachment (case-insensitive) or the MIME type is non-renderable (canShowMIMEType), else .allow. Extracted as a static, unit-tested policy function.
Reported by security researcher (Kaushik).
Issue
BrowserViewController'sWKNavigationDelegateimplements only request-side policy (decidePolicyFor navigationAction, always.allow). There is nodecidePolicyFor navigationResponse, so WKWebView's default renders any renderable MIME type inline — includingtext/htmlserved withContent-Disposition: attachment, which standard browsers download or refuse to render.Impact
An HTML file uploaded to a trusted file-hosting domain (e.g. Google Drive, served as attachment) renders inline in the in-app browser under that trusted origin — enabling convincing phishing (the page can trigger wallet connect/sign prompts while showing a trusted domain) and access to origin-bound state within the app's webview data store.
Fix
Implement
decidePolicyFor navigationResponse:.cancelwhen the response carriesContent-Disposition: attachment(case-insensitive) or the MIME type is non-renderable (canShowMIMEType), else.allow. Extracted as a static, unit-tested policy function.