WebView in Android: a complete guide to setting up and using

CompONENT WebView v Android is a powerful tool that allows you to display web content directly inside applications without having to open an external browser. For developers, this is a way to integrate dynamic content, and for ordinary users, it is a convenient method for viewing web pages in specialized applications (for example, in banking clients or instant messengers). However, many encounter problems: from basic setup to errors like ERR_CLEARTEXT_NOT_PERMITTED or net::ERR_INTERNET_DISCONNECTED.

In this article we will analyze all aspects of working with WebView - from the simplest page display to fine-tuning performance and security. You'll learn how to enable support JavaScript, handle loading errors, optimize memory consumption, and even create a minimal application with WebView in 5 minutes. We will pay special attention solutions for devices on Android 9+ (Pie) and newer, where Google has tightened the requirements for the security of web content.

What is WebView and why do you need it in Android

WebView is a system one component Android, which is a simplified browser without an interface. It is built into the operating system and is used by applications to display HTML/CSS/JS content. For example, when you open an article in Twitter or Facebook without going to Chrome, most likely it is WebView that is used.

Main advantages:

• 🔹 Easy integration: does not require the development of complex interfaces for dynamic content.
• 🔹 Saving traffic: content is loaded inside the application, without switching to the browser.
• 🔹 Control UX: you can customize behavior (for example, block redirects or modal windows).
• 🔹 Support for modern web standards: starting from Android 5.0 (Lollipop), WebView is updated via Google Play, like a regular application.

However, there are pitfalls:

• 🚫 Performance problems: each instance of WebView consumes significant resources (especially when working with heavy JS frameworks like React or Angular).
• 🚫 Vulnerabilities security: outdated versions of WebView may contain critical bugs (for example, CVE-2020-6506).
• 🚫 Restrictions on Android 9+: by default, loading of content via the protocol is blocked HTTP (only HTTPS).

⚠️ Attention: Starting from Android 10 (Q), Google requires that all applications with WebView use the current version of the component. If The device has disabled updates via Google Play, WebView may not work correctly.

How to enable and configure WebView on an Android device

If you are a regular user (not a developer), you may need to enable or update WebView for the applications to work correctly. Here is a step-by-step guide. instructions:

1. Open Settings → Applications.

2. Click on the three dots in the upper right corner and select Show system processes.

3. Find in the list Android System WebView (or just WebView).

4. Make sure that the application is Enabled. If disabled, click Enable.

5. Update WebView via Google Play (if available).

On some devices (for example, Huawei or Xiaomi with custom firmware), an alternative component may be used instead of Google WebView In this case:

• 📱 Check the availability of the application Huawei Quick App or Miui WebView.
• 🔄 If errors occur, try resetting WebView in Settings → Applications → WebView → Storage → Clear data.

If, after updating WebView, applications begin to crash, try rolling back to the previous version:

1. Open WebView page in Google Play.
2. Click on the three dots → Delete updates.

Basic implementation of WebView for developers (Java/Kotlin)

If you are developing an application and want to add a WebView, here is a minimal working example at Kotlin:

// 1. Add a WebView to the markup (activity_main.xml)
<WebView
android:id="@+id/webView"
android:layout_width="match_parent"
android:layout_height="match_parent" />

// 2. Settings in MainActivity.kt
class MainActivity : AppCompatActivity() {
override fun onCreate(savedInstanceState: Bundle?) {
super.onCreate(savedInstanceState)
setContentView(R.layout.activity_main)

val webView = findViewById<WebView>(R.id.webView)
webView.apply {
// Enable JavaScript
settings.javaScriptEnabled = true
// Allow zoom (optional)
settings.setSupportZoom(true)
settings.builtInZoomControls = true
// Load the page
loadUrl("https://example.com")
}
}

// Processing the "Back" click
override fun onBackPressed() {
val webView = findViewById<WebView>(R.id.webView)
if (webView.canGoBack()) {
webView.goBack()
} else {
super.onBackPressed()
}
}
}

For Java the code will be similar, taking into account the syntactic features. Pay attention to the key points:

• 🔧 javaScriptEnabled = true —required for working with interactive content.
• 🔍 setSupportZoom —allows you to zoom the page using gestures.
• 🔄 canGoBack() —correct processing of navigation history.

⚠️ Attention: If your application targets Android 9 (API 28) or above, by default WebView will block loading content by HTTP. To allow mixed content, add to AndroidManifest.xml:

<application
...
android:usesCleartextTraffic="true">
...
</application>

But this is not recommended for production applications! It is better to migrate to HTTPS.

Optimizing WebView performance

WebView can significantly slow down the application if it is not optimized. Here are the key recommendations:

Additional tips for difficult cases:

• 🛠️ For heavy SPA (Single Page Applications): consider using Crosswalk Project (alternative WebView with support Chromium), but note that this will increase the APK size by ~20 MB.
• 📦 For Android Go: use settings.setUseWideViewPort(true) i settings.setLoadWithOverviewMode(true) to adapt content to small screens.

Error handling and common problems

Even with the correct WebView configuration, errors may occur. Here are the most common and ways to solve them:

1. Error net::ERR_CLEARTEXT_NOT_PERMITTED

Cause: traffic by Android 9 By default, traffic is blocked by HTTPis blocked by default. Solutions:

• 🔒 Translate the site to HTTPS (recommended).
• 🛠️ Add to AndroidManifest.xml:

  <application android:usesCleartextTraffic="true">

  But this is a temporary solution - Google may block such an application in the Play Market.
• 🌐 Use WebViewClient to intercept and modify the URL:

  webView.webViewClient = object : WebViewClient() {
  override fun shouldOverrideUrlLoading(view: WebView?, request: WebResourceRequest?): Boolean {
  if (request?.url?.toString()?.startsWith("http://") == true) {
  view?.loadUrl(request.url.toString().replace("http://", "https://"))
  return true
  }
  return super.shouldOverrideUrlLoading(view, request)
  }
  }

2. White page without errors

Often caused by:

• 🚫 JavaScript blocking (check javaScriptEnabled).
• 📵 Lack of Internet (check permission INTERNET in the manifest).
• 🔄 Conflict with WebChromeClient (make sure it is configured correctly).

3. Application crash with OutOfMemoryError

WebView can consume up to 500 MB RAM on complex pages. Solutions:

• 🗑️ Unload WebView when leaving the screen:

  override fun onPause() {
  super.onPause()
  webView.onPause()
  webView.destroy() // Kills the WebView process
  }

• 📉 Limit the number of simultaneously open tabs.
• 🔄 Use webView.clearCache(true) to clear the cache.

E/chromium: [ERROR:ssl_client_socket_impl.cc(982)] handshake failed

Security: how to protect users from vulnerabilities

WebView is a common target for attacks because it runs untrusted code. Main risks:

• 🕵️‍♂️ Cross-site scripting (XSS): an attacker can inject JS code into your application.
• 🔗 Open Redirect: redirecting the user to phishing sites.
• 📤 Data leak: You can access local files through WebView.

Protection measures:

1. Disable access to the file system:

   settings.allowFileAccess = false
   settings.allowFileAccessFromFileURLs = false
   settings.allowUniversalAccessFromFileURLs = false

2. Block pop-ups and redirects:

   webView.webViewClient = object : WebViewClient() {
   override fun shouldOverrideUrlLoading(view: WebView?, request: WebResourceRequest?): Boolean {
   // Allow loading only trusted domains
   val url = request?.url?.toString() ?: return true
   return if (url.startsWith("https://trusted-domain.com")) {
   false // Allow loading
   } else {
   true // Block
   }
   }
   }

3. Use setSafeBrowsingEnabled(true) (available from Android 8.1) to block dangerous sites.

⚠️ Attention: If your application processes payments or personal data via WebView Google Play requires the use of official SDKs (for example, Google Pay API) instead of embedding payment forms through WebView. Otherwise, the application may be blocked.

WebView alternatives: when to use other solutions

WebView is not always optimal. Consider alternatives in the following cases:

If you still settled on WebView, but need advanced capabilities, pay attention on:

• 🔧 Chrome Custom Tabs: an easy way to open a browser with a customized interface (for example, hide the address bar).
• 🌐 Trust Web Activity: full-screen mode without a browser interface (used in PWA).

settings.allowFileAccess = true

val bitmap = Bitmap.createBitmap(webView.width, webView.height, Bitmap.Config.ARGB_8888)
val canvas = Canvas(bitmap)
webView.draw(canvas)
// Save to gallery
MediaStore.Images.Media.insertImage(contentResolver, bitmap, "screenshot", "WebView screenshot")

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
WebView.setWebContentsDebuggingEnabled(true)
}