Description

After a top-frame navigation fails (such as due to a TLS error), the address bar displayed above the WebView component in the Reclaim app displays the origin of the failed navigation rather than the origin of the currently displayed page.

This issue occurs in reclaim-app/src/components/DevToolWebview/index.tsx:

const DevToolWebView: React.FC<DevTollWebViewProps> = forwardRef(
  // ...
  return (
    <WebView
    // ...
    onNavigationStateChange={({ url }) => {
      ref.current?.injectJavaScript(INJECTION)
      urlInputUpdate(url)
    }}
    onLoadEnd={({ nativeEvent }) => {
      urlInputUpdate(nativeEvent.url)

Impact

Malicious pages may trigger a failed navigation to disguise themselves as a trusted origin. This can convince the user to enter their credentials or reveal other sensitive information to the attacker's website.

Recommendations

The WebView component should properly account for failed navigations and always set the address-bar text to the origin of the displayed page.

Remediation