fix: Android In-App Browser Crash

[weitingsun]

Description

The app crashes on Android when users grant camera + microphone permissions through the in-app browser (e.g., visiting https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural flaw when multiple permissions (camera + microphone) were requested simultaneously:
Old behavior: Showed separate dialogs for each permission (one for camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either grant() or deny() has been already called"

Solution:
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:

• "Allow example.com to use your camera and microphone?"
• Call grant() only once with all permissions together
• Added error handling to prevent crashes in edge cases

Android build for this PR: https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser: MetaMask/react-native-webview-mm#72

Changelog

CHANGELOG entry:null

Related issues

Fixes: #22162

Manual testing steps

Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing

Screenshots/Recordings

Before

Android Before

After

Android After

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Consolidates Android WebView permission flow into a single dialog with a single grant call for multiple resources, adds error handling, and delivers via a Yarn patch of @metamask/react-native-webview.

• Android WebView (RNCWebChromeClient.java):
  • Show a single confirmation dialog for multiple already-OS-granted permissions with a combined message.
  • Aggregate requested resources and call request.grant() once; map CAMERA → RESOURCE_VIDEO_CAPTURE, RECORD_AUDIO → RESOURCE_AUDIO_CAPTURE, handle RESOURCE_PROTECTED_MEDIA_ID.
  • Reset state before handling requests; manage permissionRequest/grantedPermissions lifecycle; only set permissionRequest when system permissions must be requested.
  • Wrap grant() with try/catch to ignore IllegalStateException and prevent duplicate grant/deny errors.
  • Minor UX: delay enabling the "Allow" button to avoid accidental taps.
• Dependencies:
  • Use Yarn patch for @metamask/react-native-webview@14.5.0 via .yarn/patches/...; update package.json and yarn.lock.

^{Written by Cursor Bugbot for commit 7396b7f. This will update automatically on new commits. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[smilingkylan]

LGTM ✅

[sethkfman]

LGTM

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud