Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?
Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?


Short answer: no.

Long answer: CSRF exploits the trust that a site has in a user's browser. CSRF protection is not intended to protect the server from a malicious user agent or from an untrustworthy user. The user is responsible for choosing a trustworthy browser.