JSI - Dynamic Android WebView Bridge Inspector
A runtime aid for Android security researchers assessing WebViews that can navigate to researcher-controlled content. JSI is intended to be loaded inside the target app’s WebView, where it can inspect the JavaScript environment the app exposes to that page.
Navigate the target WebView
Use the app’s normal URL, deep-link, redirect, or content-loading path to make the WebView load this JSI page.
Run JSI in that context
JSI compares the active page’s global namespace with a clean iframe baseline and surfaces objects that resemble injected native bridges.
Manually investigate candidates
Correlate candidate names and methods with JADX, Frida, logs, or app behavior. JSI does not invoke bridge methods or establish exploitability for you.
WebView Exposure Scan
JSI compares window to a clean <iframe> baseline, ranks unusual globals
as bridge candidates,
and records the browser/WebView fingerprint visible to the page.
No candidate functions are invoked.
Interpretation: A hit is a lead for manual validation, not proof of a vulnerability. A clean result is also not proof that no bridge exists: interfaces may be origin-gated, injected only on specific routes, attached after page load, removed during navigation, or otherwise unreachable from the context you tested.