fix: Handle messages from Android and iOS WebViews which detect iFrame urls and send them to React Native app

[Tyschenko]

Description

Issue: https://github.com/MetaMask/mobile-planning/issues/2227

We currently have an anti-fishing warning which is displayed when user opens a malicious website.
But there is a way to bypass this warning if you load a malicious website via iFrame.

Example of the malicious website: https://coin-qr.to/
Example of the website with a malicious iFrame: https://lol-au4.pages.dev/cb (opens coin-qr.to inside in the iFrame)
We can inject a JS script in the mobile browser that will check webpage's iFrames and report their URLs to the browser in MetaMask mobile app.

Related issues

Android change: MetaMask/react-native-webview-mm#60
iOS change: MetaMask/react-native-webview-mm#61

Manual testing steps

1. Go to https://lol-au4.pages.dev/cb
2. Make sure warning is displayed
3. Go to coin-qr.to
4. Make sure warning is displayed
5. Go to uniswap.org
6. Make sure NO warning is displayed

Screenshots/Recordings

Android and iOS videos:
https://github.com/user-attachments/assets/dba5ff6e-5c7b-41d6-9a8c-426dfb7dede6
https://github.com/user-attachments/assets/dd90b6d5-28c6-47de-9ee6-daa5f048ea44

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamaskbot]

Bitrise

❌❌❌ pr_smoke_e2e_pipeline failed on Bitrise! ❌❌❌

Commit hash: 5e5bccb
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/61a9a820-35bd-4734-abb7-d8e79beaf93d

Note

• You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

Tip

• Check the documentation if you have any doubts on how to understand the failure on bitrise

[github-actions]

Bitrise

✅✅✅ pr_smoke_e2e_pipeline passed on Bitrise! ✅✅✅

Commit hash: 10a253f
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/fb34cded-8c58-4138-bff9-f04eaabfeb70

Note

• You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[smilingkylan]

LGTM