Let's break down why your current setup isn't working and how to fix it to enforce URL restrictions across all WebView instances on your device.

Why Your Existing Configuration Fails #

The com.android.browser: prefixed policy keys are not intended to be placed within Chrome's (com.android.chrome) managed configuration. These keys belong to the Android System WebView framework, so applying them under Chrome's package will only trigger validation errors (like you saw in chrome://policy)—Chrome doesn't recognize those namespace-prefixed keys as part of its own policy set.

Correct Approach: Target the System WebView Package #

To enforce URL rules for all WebView apps, you need to create a separate managed configuration entry targeting the actual System WebView package installed on your device. Here's the step-by-step fix:

1. Identify the System WebView Package Name #

First, find the package name of the WebView implementation running on your device:

• Go to Settings > Apps > See all apps and look for "Android System WebView" or "Google Chrome WebView".
• Alternatively, run this ADB command to get it directly:

  adb shell pm list packages | grep webview
  

  Common package names you'll encounter:
  • com.google.android.webview (most devices with Google Mobile Services)
  • com.android.webview (AOSP-based or non-Google devices)

2. Build the Managed Configuration for WebView #

Use the package name you found to craft your policy. Here's an example using com.google.android.webview:

{
  "packageName": "com.google.android.webview",
  "managedConfiguration": {
    "com.android.browser:URLBlacklist": ["reddit.com", "youtube.com"],
    "com.android.browser:URLWhitelist": ["stackoverflow.com", "google.com"]
  }
}

3. Deploy and Verify #

• Push this configuration to your managed device(s) via your EMM/MDM platform.
• To confirm it's active:
  1. Open Chrome and navigate to chrome://policy—you should see the WebView package listed with the applied policies.
  2. Test with a WebView-based app (e.g., a simple test app that loads external URLs) to confirm blacklisted sites are blocked and whitelisted ones are accessible.

Key Notes #

• If managing a fleet with mixed device types, you may need to create separate configuration entries for different WebView package names (one for com.google.android.webview and another for com.android.webview, for example).
• The com.android.browser: namespace is a legacy convention for WebView policies, which is why these keys work universally across all WebView instances that honor managed configurations.

内容的提问来源于stack exchange，提问作者Levy Srugo