Webview

A webview is an invisible browser window built into an app. When you tap a link in an app and a webpage appears without Safari or Chrome opening, you’re in a webview. The app displays the page itself — using its own, embedded browser component. This sounds like a minor detail, but it has far-reaching consequences for what an app can do, what it’s allowed to do, and how it looks.

Webviews as a bridge between app and web

For developers, a webview is a powerful tool. It lets them embed a webpage or a web-based user interface — meaning an interface built like a website — directly into an app. This saves work: instead of building the same content once for the web and once for the app, you write it once and display it everywhere.

This is especially common in apps meant to run on many different devices. Frameworks like React Native or Electron — programs used to build apps from web technologies — rely heavily on webviews. Many desktop applications that look like regular programs are, at their core, a webview displaying a web application. Slack, VS Code, and the WhatsApp desktop app all work this way.

What happens under the hood

A webview is not a full browser. It contains what’s called a rendering engine — the software that processes HTML, CSS, and JavaScript and turns them into pixels on the screen. On Android, the underlying component is called Android WebView and is based on Chromium, the open-source core of Google Chrome. On Apple devices, it’s called WKWebView and is based on WebKit, the same engine used by Safari.

The crucial difference from a real browser: a webview has no address bar of its own, no tabs, and no security indicators visible to the user. The app controls what’s displayed — and it can read or alter the webview’s traffic. This makes webviews practical, but also a security concern. App makers could theoretically see what you type into their webview, even if the webpage being shown is encrypted.

A webview can also access device features that a normal webpage can’t reach — such as the camera or local files — because the app acts as an intermediary. This means the webview isn’t a sandbox in the classic sense, but rather a permeable window between the web and the operating system.

Where webviews show up in everyday life

Webviews are most commonly encountered on social networks. When you tap a link in a profile within the Instagram or TikTok app, no external browser opens — the app displays the target page in its own webview. This was the subject of a major debate in 2022, when developer Felix Krause demonstrated that the Instagram app was injecting JavaScript code into its webview that could, in principle, record keystrokes on third-party websites.

Payment processes within apps also often run through webviews. The payment dialog that briefly pops up when you buy something in an app and get redirected to a payment provider is usually a webview. App stores therefore have strict rules: Apple and Google require that certain payment flows run through their own systems rather than through webviews — which regularly leads to legal disputes.

In tech coverage, the term mostly comes up in discussions about privacy or platform control. The question of whether an app should open an external browser or is allowed to use its own webview isn’t a minor technical detail — it determines who retains control over the user experience and the data.