Skip to content

Conversation

@weitingsun
Copy link

@weitingsun weitingsun commented Nov 5, 2025

The app crashes on Android when users grant camera + microphone permissions through the in-app browser (e.g., visiting https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural flaw when multiple permissions (camera + microphone) were requested simultaneously:
Old behavior: Showed separate dialogs for each permission (one for camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either grant() or deny() has been already called"

Solution:
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:

"Allow example.com to use your camera and microphone?"
Call grant() only once with all permissions together
Added error handling to prevent crashes in edge cases


Note

Refactors RNCWebChromeClient to show one combined permission dialog and call grant() once with all resources, adding safe state management and error handling to prevent crashes.

  • Android WebView permissions (RNCWebChromeClient):
    • Single combined dialog for already OS-granted permissions (e.g., camera and microphone) with host-aware message; 500ms positive-button delay retained.
    • Single grant() call with all requested WebView resources; map Android permissions back to WebView resources before granting.
    • State management: reset grantedPermissions and permissionRequest; only set permissionRequest when system permissions must be requested; clean up on deny.
    • System permission flow: request missing Android permissions via requestPermissions; handle pending permissions queue as before.
    • Error handling: wrap permissionRequest.grant(...) in try/catch in both dialog path and permissions listener to avoid IllegalStateException when already resolved.

Written by Cursor Bugbot for commit 73320c4. This will update automatically on new commits. Configure here.

github-merge-queue bot pushed a commit to MetaMask/metamask-mobile that referenced this pull request Nov 5, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
this.runDelayed(() -> posButton.setEnabled(true), 500);
// Permission already granted at OS level, but still need user confirmation
permissionsNeedingDialog.add(androidPermission);
permissionLabels.add(requestPermissionIdentifier);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Null Permission Label in Protected Media Dialog

When RESOURCE_PROTECTED_MEDIA_ID permission is requested with mAllowsProtectedMedia=false, the variable requestPermissionIdentifier is never set (remains null). If this permission ends up in the permissionsNeedingDialog path (line 191-192), null is added to permissionLabels. This causes the permission dialog to display "Allow [host] to use your null?" to the user, or "camera and null" if combined with other permissions. The fix should set requestPermissionIdentifier = "protected media" or similar for the RESOURCE_PROTECTED_MEDIA_ID case at line 174-186.

Fix in Cursor Fix in Web

runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
runway-github bot added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
weitingsun added a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution:
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

Fixes: #22162

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

Android Before
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)

<!-- [screenshots/recordings] -->

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
>
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
joaoloureirop pushed a commit to MetaMask/metamask-mobile that referenced this pull request Nov 6, 2025
- fix: Android In-App Browser Crash (#22212)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:

https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android

Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android

After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding

Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling

guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Aggregates Android WebView camera/microphone permission flows into a
single confirmation and safely grants once, wired via a Yarn patch to
@metamask/react-native-webview.
> 
> - **Android WebView permissions**:
> - Reset state at request start and consolidate multiple permission
prompts into a single dialog (e.g., camera and microphone).
> - Map OS-level permissions to WebView resources and grant once (with
try/catch) to avoid IllegalStateException.
> - Request missing system permissions as needed; clean up
`grantedPermissions`/`permissionRequest` consistently.
> - **Tooling/Deps**:
> - Switch `@metamask/react-native-webview@14.5.0` to a Yarn patch via
`.yarn/patches/@metamask-react-native-webview-*.patch` and update
`yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
712412c. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
[5c63946](5c63946)

Co-authored-by: Wei Sun <wei.sun@consensys.net>
Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants