Abstract: With Android WebView component widely used, its vulnerabilities will cause significant risks, but current detection methods which rely on static pattern matching have high rate of false positives. Therefore this paper proposes an automatic detection and verification method for WebView component vulnerabilities, based on static analysis and dynamic verification combination. The reachability analysis of vulnerable suspicious points was used to avoid the futile dynamic verification of invalid paths, for improving analysis efficiency. The data dependency analysis was combined with the dynamic verification that can simulate real attack behaviors to trigger and confirm vulnerabilities timely, for reducing false positives. The prototype tool XWebViewDigger has been developed and tested on 80 real Android applications, with 18 vulnerable applications detected and verified. Compared with current methods, the false positive rate was effectively reduced.