Using a built-in WebView2 function, JavaScript can be easily injected into any website. The research was difficult and time consuming as I had to read a lot of documentation and do a lot of debugging to understand the internal workings of WebView2. My code uses a modified version of Microsoft’s WebView2 Samples repository. In this post I discuss and show how attackers can create WebView2 applications and use them for several purposes. The main advantage of using WebView2 for attackers is the rich functionality it provides when phishing for credentials and sessions. The image below is an example of WebView2 being used in a legitimate Microsoft Office application. This is meant to improve desktop applications and provide them with additional capabilities for interaction with web applications. Essentially, WebView2 technology can be used to create an executable that can communicate with web applications similarly to a browser. IntroductionĪccording to Microsoft, “Microsoft Edge WebView2 control allows you to embed web technologies (HTML, CSS, and JavaScript) in your native apps”. Exploring WebView2 applications and how they can be used for credential and cookie theft.

Ms edge webview2