WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.Bruno Halltari, Caue Obici, Nikolaos Mourousias
