Arbitrary Code Execution via WebView.addJavascriptInterface in Android 3.0–4.1.x

This repository contains a single Metasploit module: 'Android Browser and WebView addJavascriptInterface Code Execution'. The module targets a critical vulnerability in Android's WebView component (pre-4.2) and some Android browsers, where the addJavascriptInterface method exposes Java reflection APIs to untrusted JavaScript, allowing remote code execution. The exploit is delivered via a malicious web page (served by Metasploit's BrowserExploitServer), which detects the victim's architecture and serves the appropriate JavaScript payload. The default payload is a Meterpreter reverse shell, but any compatible Metasploit Android payload can be used. The module is highly weaponized, supporting automatic targeting and architecture detection, and is suitable for both direct exploitation (malicious link) and secondary attacks (e.g., via MITM or XSS in apps embedding WebViews). The code is well-structured, with clear separation of exploit delivery, architecture detection, and payload serving. The only fingerprintable endpoint is the dynamically generated HTTP(S) URL used to deliver the exploit content.