Description

The Reclaim WebView updates the address bar to the new origin while displaying the previous origin's content without any indication that the new page is loading. This may confuse users and lead to phishing attacks.

The address-bar change occurs in reclaim-app/src/components/DevToolWebview/index.tsx:

const DevToolWebView: React.FC<DevTollWebViewProps> = forwardRef(
  // ...
  return (
    <WebView
    // ...
    onNavigationStateChange={({ url }) => {
      ref.current?.injectJavaScript(INJECTION)
      urlInputUpdate(url)
    }}

Impact

An attacker can intentionally slow down the loading of the new page, allowing them to display a phishing page with a legitimate-looking address bar. This may lead users to believe they are visiting a trusted website and choose to enter their credentials or other sensitive information.

Recommendations

The WebView component should indicate when the page is loading with a spinner or similar UI element.

Remediation