WebViewCompat

addWebMessageListener

@RequiresFeature(name = WebViewFeature.WEB_MESSAGE_LISTENER, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void addWebMessageListener(
    @NonNull WebView webView,
    @NonNull String jsObjectName,
    @NonNull Set<String> allowedOriginRules,
    @NonNull WebViewCompat.WebMessageListener listener
)

Adds a WebMessageListener to the WebView and injects a JavaScript object into each frame that the WebMessageListener will listen on.

The injected JavaScript object will be named jsObjectName in the global scope. This will inject the JavaScript object in any frame whose origin matches allowedOriginRules for every navigation after this call, and the JavaScript object will be available immediately when the page begins to load.

Each allowedOriginRules entry must follow the format SCHEME "://" [ HOSTNAME_PATTERN [ ":" PORT ] ], each part is explained in the below table:

Rule	Description	Example
http/https with hostname	SCHEME is http or https; HOSTNAME_PATTERN is a regular hostname; PORT is optional, when not present, the rule will match port 80 for http and port 443 for https.	https://foobar.com:8080 - Matches https:// URL on port 8080, whose normalized host is foobar.com. https://www.example.com - Matches https:// URL on port 443, whose normalized host is www.example.com.
http/https with pattern matching	SCHEME is http or https; HOSTNAME_PATTERN is a sub-domain matching pattern with a leading *.; PORT is optional, when not present, the rule will match port 80 for http and port 443 for https.	https://*.example.com - Matches https://calendar.example.com and https://foo.bar.example.com but not https://example.com. https://*.example.com:8080 - Matches https://calendar.example.com:8080
http/https with IP literal	SCHEME is https or https; HOSTNAME_PATTERN is IP literal; PORT is optional, when not present, the rule will match port 80 for http and port 443 for https.	https://127.0.0.1 - Matches https:// URL on port 443, whose IPv4 address is 127.0.0.1 https://[::1] or https://[0:0::1]- Matches any URL to the IPv6 loopback address with port 443. https://[::1]:99 - Matches any https:// URL to the IPv6 loopback on port 99.
Custom scheme	SCHEME is a custom scheme; HOSTNAME_PATTERN and PORT must not be present.	my-app-scheme:// - Matches any my-app-scheme:// URL.
*	Wildcard rule, matches any origin.	*

Note that this is a powerful API, as the JavaScript object will be injected when the frame's origin matches any one of the allowed origins. The HTTPS scheme is strongly recommended for security; allowing HTTP origins exposes the injected object to any potential network-based attackers. If a wildcard "*" is provided, it will inject the JavaScript object to all frames. A wildcard should only be used if the app wants any third party web page to be able to use the injected object. When using a wildcard, the app must treat received messages as untrustworthy and validate any data carefully.

This method can be called multiple times to inject multiple JavaScript objects.

Let's say the injected JavaScript object is named myObject. We will have following methods on that object once it is available to use:

// Web page (in JavaScript)
// message needs to be a JavaScript String, MessagePorts is an optional parameter.
myObject.postMessage(message[, MessagePorts])

// To receive messages posted from the app side, assign a function to the "onmessage"
// property. This function should accept a single "event" argument. "event" has a "data"
// property, which is the message string from the app side.
myObject.onmessage = function(event) { ... }

// To be compatible with DOM EventTarget's addEventListener, it accepts type and listener
// parameters, where type can be only "message" type and listener can only be a JavaScript
// function for myObject. An event object will be passed to listener with a "data" property,
// which is the message string from the app side.
myObject.addEventListener(type, listener)

// To be compatible with DOM EventTarget's removeEventListener, it accepts type and listener
// parameters, where type can be only "message" type and listener can only be a JavaScript
// function for myObject.
myObject.removeEventListener(type, listener)

We start the communication between JavaScript and the app from the JavaScript side. In order to send message from the app to JavaScript, it needs to post a message from JavaScript first, so the app will have a JavaScriptReplyProxy object to respond. Example:

// Web page (in JavaScript)
myObject.onmessage = function(event) {
  // prints "Got it!" when we receive the app's response.
  console.log(event.data);
}
myObject.postMessage("I'm ready!");

// App (in Java)
WebMessageListener myListener = new WebMessageListener() {
  @Override
  public void onPostMessage(WebView view, WebMessageCompat message, Uri sourceOrigin,
           boolean isMainFrame, JavaScriptReplyProxy replyProxy) {
    // do something about view, message, sourceOrigin and isMainFrame.
    replyProxy.postMessage("Got it!");
  }
};
if (WebViewFeature.isFeatureSupported(WebViewFeature.WEB_MESSAGE_LISTENER)) {
  WebViewCompat.addWebMessageListener(webView, "myObject", rules, myListener);
}

This method should only be called if isFeatureSupported returns true for WEB_MESSAGE_LISTENER.

createWebMessageChannel

@RequiresFeature(name = WebViewFeature.CREATE_WEB_MESSAGE_CHANNEL, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static @NonNull WebMessagePortCompat[] createWebMessageChannel(@NonNull WebView webview)

Creates a message channel to communicate with JS and returns the message ports that represent the endpoints of this message channel. The HTML5 message channel functionality is described here

The returned message channels are entangled and already in started state.

This method should only be called if isFeatureSupported returns true for CREATE_WEB_MESSAGE_CHANNEL.

getCurrentWebViewPackage

public static @Nullable PackageInfo getCurrentWebViewPackage(@NonNull Context context)

If WebView has already been loaded into the current process this method will return the package that was used to load it. Otherwise, the package that would be used if the WebView was loaded right now will be returned; this does not cause WebView to be loaded, so this information may become outdated at any time. The WebView package changes either when the current WebView package is updated, disabled, or uninstalled. It can also be changed through a Developer Setting. If the WebView package changes, any app process that has loaded WebView will be killed. The next time the app starts and loads WebView it will use the new WebView package instead.

getSafeBrowsingPrivacyPolicyUrl

@RequiresFeature(name = WebViewFeature.SAFE_BROWSING_PRIVACY_POLICY_URL, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static @NonNull Uri getSafeBrowsingPrivacyPolicyUrl()

Returns a URL pointing to the privacy policy for Safe Browsing reporting.

This method should only be called if isFeatureSupported returns true for SAFE_BROWSING_PRIVACY_POLICY_URL.

getVariationsHeader

@RequiresFeature(name = WebViewFeature.GET_VARIATIONS_HEADER, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static @NonNull String getVariationsHeader()

Gets the WebView variations encoded to be used as the X-Client-Data HTTP header.

The app is responsible for adding the X-Client-Data header to any request that may use variations metadata, such as requests to Google web properties. The returned string will be a base64 encoded ClientVariations proto: https://source.chromium.org/chromium/chromium/src/+/main:components/variations/proto/client_variations.proto

getWebChromeClient

@RequiresFeature(name = WebViewFeature.GET_WEB_CHROME_CLIENT, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static @Nullable WebChromeClient getWebChromeClient(@NonNull WebView webview)

Gets the WebChromeClient.

This method should only be called if isFeatureSupported returns true for GET_WEB_CHROME_CLIENT.

getWebViewClient

@RequiresFeature(name = WebViewFeature.GET_WEB_VIEW_CLIENT, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static @NonNull WebViewClient getWebViewClient(@NonNull WebView webview)

Gets the WebViewClient for the WebView argument.

This method should only be called if isFeatureSupported returns true for GET_WEB_VIEW_CLIENT.

getWebViewRenderProcess

@RequiresFeature(name = WebViewFeature.GET_WEB_VIEW_RENDERER, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static @Nullable WebViewRenderProcess getWebViewRenderProcess(@NonNull WebView webview)

Gets the WebView renderer associated with this WebView.

In Android O and above, WebView may run in "multiprocess" mode. In multiprocess mode, rendering of web content is performed by a sandboxed renderer process separate to the application process. This renderer process may be shared with other WebViews in the application, but is not shared with other application processes.

If WebView is running in multiprocess mode, this method returns a handle to the renderer process associated with the WebView, which can be used to control the renderer process.

This method should only be called if isFeatureSupported returns true for GET_WEB_VIEW_RENDERER.

getWebViewRenderProcessClient

@RequiresFeature(name = WebViewFeature.WEB_VIEW_RENDERER_CLIENT_BASIC_USAGE, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static @Nullable WebViewRenderProcessClient getWebViewRenderProcessClient(@NonNull WebView webview)

Gets the renderer client object associated with this WebView.

This method should only be called if isFeatureSupported returns true for WEB_VIEW_RENDERER_CLIENT_BASIC_USAGE.

isMultiProcessEnabled

@RequiresFeature(name = WebViewFeature.MULTI_PROCESS, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static boolean isMultiProcessEnabled()

Returns true if WebView is running in multi process mode.

In Android O and above, WebView may run in "multiprocess" mode. In multiprocess mode, rendering of web content is performed by a sandboxed renderer process separate to the application process. This renderer process may be shared with other WebViews in the application, but is not shared with other application processes.

postVisualStateCallback

@RequiresFeature(name = WebViewFeature.VISUAL_STATE_CALLBACK, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void postVisualStateCallback(
    @NonNull WebView webview,
    long requestId,
    @NonNull WebViewCompat.VisualStateCallback callback
)

Posts a VisualStateCallback, which will be called when the current state of the WebView is ready to be drawn.

Because updates to the DOM are processed asynchronously, updates to the DOM may not immediately be reflected visually by subsequent onDraw invocations. The VisualStateCallback provides a mechanism to notify the caller when the contents of the DOM at the current time are ready to be drawn the next time the WebView draws.

The next draw after the callback completes is guaranteed to reflect all the updates to the DOM up to the point at which the VisualStateCallback was posted, but it may also contain updates applied after the callback was posted.

The state of the DOM covered by this API includes the following:

• primitive HTML elements (div, img, span, etc..)
• images
• CSS animations
• WebGL
• canvas

It does not include the state of:

• the video tag

To guarantee that the WebView will successfully render the first frame after the onComplete method has been called a set of conditions must be met:

• If the WebView's visibility is set to VISIBLE then * the WebView must be attached to the view hierarchy.
• If the WebView's visibility is set to INVISIBLE then the WebView must be attached to the view hierarchy and must be made VISIBLE from the onComplete method.
• If the WebView's visibility is set to GONE then the WebView must be attached to the view hierarchy and its LayoutParams's width and height need to be set to fixed values and must be made VISIBLE from the onComplete method.

When using this API it is also recommended to enable pre-rasterization if the is off screen to avoid flickering. See setOffscreenPreRaster for more details and do consider its caveats.

This method should only be called if isFeatureSupported returns true for VISUAL_STATE_CALLBACK.

postWebMessage

@RequiresFeature(name = WebViewFeature.POST_WEB_MESSAGE, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void postWebMessage(
    @NonNull WebView webview,
    @NonNull WebMessageCompat message,
    @NonNull Uri targetOrigin
)

Post a message to main frame. The embedded application can restrict the messages to a certain target origin. See HTML5 spec for how target origin can be used.

A target origin can be set as a wildcard ("*"). However this is not recommended. See the page above for security issues.

This method should only be called if isFeatureSupported returns true for POST_WEB_MESSAGE.

removeWebMessageListener

@RequiresFeature(name = WebViewFeature.WEB_MESSAGE_LISTENER, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void removeWebMessageListener(
    @NonNull WebView webview,
    @NonNull String jsObjectName
)

Removes the WebMessageListener associated with jsObjectName.

Note that after this call, the injected JavaScript object is still in the JavaScript context, however any message sent after this call won't reach the WebMessageListener.

This method should only be called if isFeatureSupported returns true for WEB_MESSAGE_LISTENER.

setSafeBrowsingAllowlist

@RequiresFeature(name = WebViewFeature.SAFE_BROWSING_ALLOWLIST, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void setSafeBrowsingAllowlist(
    @NonNull Set<String> hosts,
    @Nullable ValueCallback<Boolean> callback
)

Configures a set of hosts (domain names/IP addresses) that are exempt from SafeBrowsing checks. The set is global for all the WebViews.

Each rule should take one of these:

Rule	Example	Matches Subdomain
HOSTNAME	example.com	Yes
.HOSTNAME	.example.com	No
IPV4_LITERAL	192.168.1.1	No
IPV6_LITERAL_WITH_BRACKETS	[10:20:30:40:50:60:70:80]	No

All other rules, including wildcards, are invalid.

The correct syntax for hosts is defined by RFC 3986.

This method should only be called if isFeatureSupported returns true for SAFE_BROWSING_ALLOWLIST.

setSafeBrowsingWhitelist

@RequiresFeature(name = WebViewFeature.SAFE_BROWSING_WHITELIST, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void setSafeBrowsingWhitelist(
    @NonNull List<String> hosts,
    @Nullable ValueCallback<Boolean> callback
)

Sets the list of hosts (domain names/IP addresses) that are exempt from SafeBrowsing checks. The list is global for all the WebViews.

Each rule should take one of these:

Rule	Example	Matches Subdomain
HOSTNAME	example.com	Yes
.HOSTNAME	.example.com	No
IPV4_LITERAL	192.168.1.1	No
IPV6_LITERAL_WITH_BRACKETS	[10:20:30:40:50:60:70:80]	No

All other rules, including wildcards, are invalid.

The correct syntax for hosts is defined by RFC 3986.

This method should only be called if isFeatureSupported returns true for SAFE_BROWSING_WHITELIST.

setWebViewRenderProcessClient

@RequiresFeature(name = WebViewFeature.WEB_VIEW_RENDERER_CLIENT_BASIC_USAGE, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void setWebViewRenderProcessClient(
    @NonNull WebView webview,
    @Nullable WebViewRenderProcessClient webViewRenderProcessClient
)

Sets the renderer client object associated with this WebView.

See setWebViewRenderProcessClient for details, with the following differences:

Callbacks will execute directly on the thread on which this WebView was instantiated.

Passing null for webViewRenderProcessClient will clear the renderer client object for this WebView.

This method should only be called if isFeatureSupported returns true for WEB_VIEW_RENDERER_CLIENT_BASIC_USAGE.

setWebViewRenderProcessClient

@RequiresFeature(name = WebViewFeature.WEB_VIEW_RENDERER_CLIENT_BASIC_USAGE, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void setWebViewRenderProcessClient(
    @NonNull WebView webview,
    @NonNull Executor executor,
    @NonNull WebViewRenderProcessClient webViewRenderProcessClient
)

Sets the renderer client object associated with this WebView.

The renderer client encapsulates callbacks relevant to WebView renderer state. See WebViewRenderProcessClient for details.

Although many WebView instances may share a single underlying renderer, and renderers may live either in the application process, or in a sandboxed process that is isolated from the application process, instances of WebViewRenderProcessClient are set per-WebView. Callbacks represent renderer events from the perspective of this WebView, and may or may not be correlated with renderer events affecting other WebViews.

The renderer client encapsulates callbacks relevant to WebView renderer state. See WebViewRenderProcessClient for details.

Although many WebView instances may share a single underlying renderer, and renderers may live either in the application process, or in a sandboxed process that is isolated from the application process, instances of WebViewRenderProcessClient are set per-WebView. Callbacks represent renderer events from the perspective of this WebView, and may or may not be correlated with renderer events affecting other WebViews.

This method should only be called if isFeatureSupported returns true for WEB_VIEW_RENDERER_CLIENT_BASIC_USAGE.

startSafeBrowsing

@RequiresFeature(name = WebViewFeature.START_SAFE_BROWSING, enforcement = "androidx.webkit.WebViewFeature#isFeatureSupported")
public static void startSafeBrowsing(
    @NonNull Context context,
    @Nullable ValueCallback<Boolean> callback
)

Starts Safe Browsing initialization.

URL loads are not guaranteed to be protected by Safe Browsing until after callback is invoked with true. Safe Browsing is not fully supported on all devices. For those devices callback will receive false.

This should not be called if Safe Browsing has been disabled by manifest tag or setSafeBrowsingEnabled. This prepares resources used for Safe Browsing.

This should be called with the Application Context (and will always use the Application context to do its work regardless).

This method should only be called if isFeatureSupported returns true for START_SAFE_BROWSING.