We have created a mobile app that includes a view for payment with credit cards. We have used Cordova so we can pusblish our app for Android and iOS. During some tests an SQLite file was found on /data/data/[package]/app_webview/Web Data
. This file includes tables named credit_card
and whaever_credit_card
. Those who found that file didn't mention if this file actually contains credit card numbers or is empty.
I have search this problem and I have found an explanation for it but I am not sure if it is right:
- It is a file created by Android web view for credit card autofilling purposes.
- It can only be accessed with root permissions.
Just to make sure, we are not doing anything with the credit card the user insert in the input field.
Can anyone elaborate on the security risks? Can anyone propose a way to delete the file or disable it with javascript in cordova or plugin?