...
Automatic detection of a call to the addJavascriptInterface() method in a WebView is straightforward. Automatic detection of if the minimum API is set to JELLY_BEAN_MR1 in the app manifest is straightforward. Determination of whether the WebView could contain untrusted content could be impossible to do in an automated way for some applications.
Related Guidelines
| [The CERT Oracle Secure Coding Standard for Java] | SEC05-J. Do not use reflection to increase accessibility of classes, methods, or fields |
Bibliography
...