If you look into the developer site it is clearly mentioned that
If your app targets Android 7.1 (API level 25) or lower, you can opt your WebView objects out of checking URLs against Google Safe Browsing's list of unsafe websites by adding the following
element to your app’s manifest file:
<manifest>
<application>
<meta-data android:name="android.webkit.WebView.EnableSafeBrowsing"
android:value="false" />
...
</application>
</manifest>
For Android 8.0 it is clearly mentioned that
While the default value of EnableSafeBrowsing is true, there are occasional cases when you may want to only enable Safe Browsing
conditionally or disable it. Android 8.0 (API level 26) and higher
support using setSafeBrowsingEnabled(). Apps compiling at lower API
levels cannot use setSafeBrowsingEnabled() and should change the value
of EnableSafeBrowsing in the manifest to false to disable the feature
for all instances of WebView.
If you target Android 8.1 (API level 27) or higher, you can define programmatically how your app responds to a known threat:
- You can control whether your app reports known threats to Safe
Browsing.
- You can have your app automatically perform a particular action—such
as going back to safety—each time it encounters a URL that's
classified as a known threat.
Please look into the below sample code, it show how you can instruct your app's instances of WebView to always go back to safety after encountering a known threat:
MyWebActivity.java
private WebView mSuperSafeWebView;
private boolean mSafeBrowsingIsInitialized;
@Override
protected void onCreate(Bundle savedInstanceState)
{
super.onCreate(savedInstanceState);
mSuperSafeWebView = new WebView(this);
mSuperSafeWebView.setWebViewClient(new MyWebViewClient());
mSafeBrowsingIsInitialized = false;
mSuperSafeWebView.startSafeBrowsing(this, new ValueCallback<Boolean>() {
@Override
public void onReceiveValue(Boolean success) {
mSafeBrowsingIsInitialized = true;
if (!success) {
Log.e("MY_APP_TAG", "Unable to initialize Safe Browsing!");
}
}
});
}
For enable or disable Safe Browsing. Use the following method.
mSuperSafeWebView.getSettings().setSafeBrowsingEnabled(true);
MyWebViewClient.java
public class MyWebViewClient extends WebViewClient {
// Automatically go "back to safety" when attempting to load a website that
// Google has identified as a known threat. An instance of WebView calls
// this method only after Safe Browsing is initialized, so there's no
// conditional logic needed here.
@Override
public void onSafeBrowsingHit(WebView view, WebResourceRequest request,
int threatType, SafeBrowsingResponse callback) {
// The "true" argument indicates that your app reports incidents like
// this one to Safe Browsing.
callback.backToSafety(true);
Toast.makeText(view.getContext(), "Unsafe web page blocked.",
Toast.LENGTH_LONG).show();
}
}
Please take look If you want to know about the WebView security version by version.
