Each element has its own mode selector — or use the header buttons to set all at once
Tests localStorage, sessionStorage, IndexedDB, and Cache API availability and write/read access.
localStorage
Ready
sessionStorage
Click to test sessionStorage
IndexedDB
Tests IndexedDB open + put + get
Cache API
Tests Service Worker Cache API availability
Tests the Geolocation API. In an embedded browser, geolocation may be disabled or always denied for privacy reasons.
Geolocation Request
Requests current position via navigator.geolocation
watchPosition Test
Streams position updates
Loads /example.pdf via three different HTML embedding methods: <iframe>, <embed>, and <object>. Each behaves differently across browsers and WebView implementations — a method that renders blank is not necessarily an error in the others.
Method 1 — <iframe>
Most common approach; relies on browser PDF plugin
<embed> does not fire onload — blank area above means the PDF plugin is unavailable or blocked
Method 3 — <object>
Legacy embed with fallback content support
⚠ object PDF Load Error
Method 4 — pdf.js (Canvas renderer)
Mozilla pdf.js from /pdf.js — no browser PDF plugin needed
— / —
⚠ pdf.js Error
Click "Load" to render /example.pdf via pdf.js
Loads /pdf.js then fetches and renders /example.pdf page by page onto <canvas> elements
PDF Fetch Probe
Verifies /example.pdf is reachable via HTTP
Click to check HTTP status of /example.pdf
⚠ Security Test
Tests whether the embedded browser allows the user to open a native OS file picker dialog via <input type="file"> and the File API.
If the dialog opens and files can be selected, this is a medium-risk finding — a compromised or malicious page could exfiltrate file metadata.
⬡ Threat level: Medium — native dialog should be blocked or sandboxed
Standard Input[type=file] Dialog
Triggers native OS file picker
If the file picker opens: SECURITY RISK DETECTED
No files selected yet — dialog not opened
Waiting for user interaction …
Programmatic File Trigger
Attempts to open dialog without user gesture
// Attempts to open file dialog without user click:
const input = document.createElement('input');
input.type = 'file';
input.click(); // Should be blocked by browser policy
Tests File System Access API — grants content read
⚠ Security Test
Attempts various techniques a malicious page might use to escape the browser sandbox and access local filesystem data.
In a correctly configured embedded browser these should all fail. Any success is a high-severity finding.
// Attempts to navigate to or fetch local files:
fetch('file:///etc/passwd')
fetch('file:///C:/Windows/System32/drivers/etc/hosts')
window.open('file:///etc/passwd')
Click Test to attempt file:// protocol requests
2. XMLHttpRequest to file://
XHR sync/async against local paths
const xhr = new XMLHttpRequest();
xhr.open('GET', 'file:///etc/hosts', false); // sync
xhr.send(); // Should throw CORS / network error
Tests XHR against file:// paths
3. iframe src=file://
Embed local file in iframe
const f = document.createElement('iframe');
f.src = 'file:///etc/passwd';
document.body.appendChild(f);
// Then attempt to read f.contentDocument
Attempts iframe pointing to local file
4. WebSocket to localhost
Probes local services
// Probes common localhost ports via WebSocket:
// ws://localhost:8080, :3000, :5000, :22
// A successful connection reveals a running service
Tests WebSocket connection to localhost services
5. DNS Rebinding Simulation
Host header injection attempt
// Simulates DNS rebinding by fetching localhost
// via HTTP from an external-origin page context
fetch('http://localhost/')
fetch('http://127.0.0.1:8080/api/admin')
