[GH-ISSUE #3684] [Feature] Microsoft WebView2 reverse engineering: host objects, web messages, injected scripts and native-to-web boundary reconstruction #1396

New issue

Open

opened 2026-10-16 21:05:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:04 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3684

Problem Statement & Context

Microsoft WebView2—backed by the Evergreen/Fixed Chromium Edge runtime—is ubiquitous across modern Windows 10 and Windows 11 systems, serving as the web UI foundation for enterprise software, native C++ desktop shells, .NET WPF/WinForms apps, WinUI 3, and Office add-ins.

While REA has capabilities for inspecting PE/.NET executables, extracting JavaScript bundles, and connecting to CDP, it does not understand WebView2's native-to-web architecture. When analyzing a WebView2 application, security researchers, reverse engineers, and compliance auditors face a fractured boundary:

Host Object Injection (AddHostObjectToScript / COM IDispatch): Native COM objects or .NET classes bridged into JavaScript runtime under window.chrome.webview.hostObjects.
Web Message Exchange (PostWebMessageAsJson, PostWebMessageAsString, WebMessageReceived): Asynchronous IPC between the native host and the embedded webpage.
Injected Bootstrap Scripts (AddScriptToExecuteOnDocumentCreated, ExecuteScriptAsync): JavaScript injected at document creation time before any page DOM executes.
Custom URI Schemes & Web Resource Interception (AddWebResourceRequestedFilter, WebResourceRequested): Native handlers acting as internal HTTP servers, serving proprietary in-memory assets or tampering with network requests.
Runtime Isolation & User Data Directory (userDataFolder, process models): Profiles, cached storage, cookies, and local state isolation.

Without a dedicated WebView2 analyzer, analysts must manually correlate native COM vtables / .NET P/Invokes with frontend DOM listeners.

Proposed Architecture

flowchart TD
    A["WebView2 Application (PE / .NET / WinUI)"] --> B["WebView2 Semantic Analyzer"]
    B --> C["Native Host Interface Extractor (COM / .NET)"]
    B --> D["Web-to-Native Bridge Analyzer"]
    B --> E["Frontend Asset & Script Inspector"]
    
    C --> C1["ICoreWebView2 / CoreWebView2 API Calls"]
    C --> C2["WebResourceRequested Interception Handlers"]
    C --> C3["Environment Options & UserDataFolder"]
    
    D --> D1["AddHostObjectToScript (COM / IDispatch / Dispatcher)"]
    D --> D2["Web Message Channels (PostWebMessage / WebMessageReceived)"]
    D --> D3["Injected Pre-Load Scripts (AddScriptToExecuteOnDocumentCreated)"]
    
    E --> E1["Frontend Bundles & window.chrome.webview References"]
    E --> E2["Custom Virtual Schemes (e.g. app://, custom://)"]
    
    C & D & E --> F["End-to-End Native ↔ WebView2 ↔ JavaScript Interaction Graph"]

Technical Capabilities & Modules

Native WebView2 API Call Site Discovery:
- Detect static imports and COM QueryInterface patterns for ICoreWebView2, ICoreWebView2Controller, ICoreWebView2Environment, and managed wrappers (Microsoft.Web.WebView2.Core).
- Identify initialization configurations: CreateCoreWebView2EnvironmentWithOptions, user data folder location, browser arguments, and target runtime versions.
Host Object & COM Bridge Reconstruction:
- Identify calls to AddHostObjectToScript / AddHostObjectToScriptWithOrigins.
- Resolve registered JavaScript property names and correlate them to native COM CLSIDs, type libraries, or managed exposed types.
- Reconstruct exposed methods, properties, argument types, and security exposure (e.g., origin filtering policies).
Web Message IPC Protocol Recovery:
- Map native message senders (PostWebMessageAsJson, PostWebMessageAsString) and event sinks (add_WebMessageReceived, WebMessageReceivedEventHandler).
- Correlate with frontend calls: window.chrome.webview.postMessage and window.chrome.webview.addEventListener('message', ...).
- Infer structured JSON schemas exchanged across the native-web boundary.
Injected Pre-load Script Recovery:
- Extract string literals and resources passed to AddScriptToExecuteOnDocumentCreated / ExecuteScriptAsync.
- Decompile and parse injected scripts to identify monkey-patched globals, security polyfills, or communication stubs.
Custom Scheme & Virtual Host Mapping:
- Detect SetVirtualHostNameToFolderMapping and add_WebResourceRequested filters.
- Map virtual URIs to native disk paths or dynamic in-memory response generators (e.g. CreateWebResourceResponse).

Acceptance Criteria

Automatic identification of WebView2 usage in PE (C/C++), .NET (WPF/WinForms), and WinUI binaries.
Extraction of all registered host objects, exposed methods, and origin restrictions.
Bidirectional mapping of web message event handlers between native host code and web JavaScript.
Extraction and analysis of scripts registered via AddScriptToExecuteOnDocumentCreated.
Synthesis of an end-to-end interactive flowchart depicting native-web control and data flow.

Complements #3618 (ActiveX, COM, and OCX reverse engineering)
Complements #3636 (Windows XAML UI reconstruction: WPF BAML, UWP/WinUI XBF)
Complements #3608 (React Semantic Reconstruction & Decompiler Engine)
Complements #117 (Full-stack reconstruction)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3684 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context Microsoft WebView2—backed by the Evergreen/Fixed Chromium Edge runtime—is ubiquitous across modern Windows 10 and Windows 11 systems, serving as the web UI foundation for enterprise software, native C++ desktop shells, .NET WPF/WinForms apps, WinUI 3, and Office add-ins. While REA has capabilities for inspecting PE/.NET executables, extracting JavaScript bundles, and connecting to CDP, it does not understand WebView2's native-to-web architecture. When analyzing a WebView2 application, security researchers, reverse engineers, and compliance auditors face a fractured boundary: 1. **Host Object Injection (`AddHostObjectToScript` / COM IDispatch)**: Native COM objects or .NET classes bridged into JavaScript runtime under `window.chrome.webview.hostObjects`. 2. **Web Message Exchange (`PostWebMessageAsJson`, `PostWebMessageAsString`, `WebMessageReceived`)**: Asynchronous IPC between the native host and the embedded webpage. 3. **Injected Bootstrap Scripts (`AddScriptToExecuteOnDocumentCreated`, `ExecuteScriptAsync`)**: JavaScript injected at document creation time before any page DOM executes. 4. **Custom URI Schemes & Web Resource Interception (`AddWebResourceRequestedFilter`, `WebResourceRequested`)**: Native handlers acting as internal HTTP servers, serving proprietary in-memory assets or tampering with network requests. 5. **Runtime Isolation & User Data Directory (`userDataFolder`, process models)**: Profiles, cached storage, cookies, and local state isolation. Without a dedicated WebView2 analyzer, analysts must manually correlate native COM vtables / .NET P/Invokes with frontend DOM listeners. ### Proposed Architecture ```mermaid flowchart TD A["WebView2 Application (PE / .NET / WinUI)"] --> B["WebView2 Semantic Analyzer"] B --> C["Native Host Interface Extractor (COM / .NET)"] B --> D["Web-to-Native Bridge Analyzer"] B --> E["Frontend Asset & Script Inspector"] C --> C1["ICoreWebView2 / CoreWebView2 API Calls"] C --> C2["WebResourceRequested Interception Handlers"] C --> C3["Environment Options & UserDataFolder"] D --> D1["AddHostObjectToScript (COM / IDispatch / Dispatcher)"] D --> D2["Web Message Channels (PostWebMessage / WebMessageReceived)"] D --> D3["Injected Pre-Load Scripts (AddScriptToExecuteOnDocumentCreated)"] E --> E1["Frontend Bundles & window.chrome.webview References"] E --> E2["Custom Virtual Schemes (e.g. app://, custom://)"] C & D & E --> F["End-to-End Native ↔ WebView2 ↔ JavaScript Interaction Graph"] ``` ### Technical Capabilities & Modules 1. **Native WebView2 API Call Site Discovery:** - Detect static imports and COM QueryInterface patterns for `ICoreWebView2`, `ICoreWebView2Controller`, `ICoreWebView2Environment`, and managed wrappers (`Microsoft.Web.WebView2.Core`). - Identify initialization configurations: `CreateCoreWebView2EnvironmentWithOptions`, user data folder location, browser arguments, and target runtime versions. 2. **Host Object & COM Bridge Reconstruction:** - Identify calls to `AddHostObjectToScript` / `AddHostObjectToScriptWithOrigins`. - Resolve registered JavaScript property names and correlate them to native COM CLSIDs, type libraries, or managed exposed types. - Reconstruct exposed methods, properties, argument types, and security exposure (e.g., origin filtering policies). 3. **Web Message IPC Protocol Recovery:** - Map native message senders (`PostWebMessageAsJson`, `PostWebMessageAsString`) and event sinks (`add_WebMessageReceived`, `WebMessageReceivedEventHandler`). - Correlate with frontend calls: `window.chrome.webview.postMessage` and `window.chrome.webview.addEventListener('message', ...)`. - Infer structured JSON schemas exchanged across the native-web boundary. 4. **Injected Pre-load Script Recovery:** - Extract string literals and resources passed to `AddScriptToExecuteOnDocumentCreated` / `ExecuteScriptAsync`. - Decompile and parse injected scripts to identify monkey-patched globals, security polyfills, or communication stubs. 5. **Custom Scheme & Virtual Host Mapping:** - Detect `SetVirtualHostNameToFolderMapping` and `add_WebResourceRequested` filters. - Map virtual URIs to native disk paths or dynamic in-memory response generators (e.g. `CreateWebResourceResponse`). ### Acceptance Criteria - [ ] Automatic identification of WebView2 usage in PE (C/C++), .NET (WPF/WinForms), and WinUI binaries. - [ ] Extraction of all registered host objects, exposed methods, and origin restrictions. - [ ] Bidirectional mapping of web message event handlers between native host code and web JavaScript. - [ ] Extraction and analysis of scripts registered via `AddScriptToExecuteOnDocumentCreated`. - [ ] Synthesis of an end-to-end interactive flowchart depicting native-web control and data flow. ### Related Issues & Dependencies - Complements #3618 (ActiveX, COM, and OCX reverse engineering) - Complements #3636 (Windows XAML UI reconstruction: WPF BAML, UWP/WinUI XBF) - Complements #3608 (React Semantic Reconstruction & Decompiler Engine) - Complements #117 (Full-stack reconstruction)

bsakaguchi referenced this issue

2026-10-17 21:11:01 +00:00

[PR #1393] [MERGED] fix(javascript): stop reading media preload attributes as Electron preloads #2850

bsakaguchi referenced this issue

2026-10-17 21:11:02 +00:00

[PR #1396] [MERGED] fix(browser): classify selected web trace file failures by cause #2853