Web Share API - Level 2

1. Usage Examples

This section is non-normative.

This example shows a basic share operation. In response to a button click, this JavaScript code shares the current page's URL.

shareButton.addEventListener("click", async () => {
  try {
    await navigator.share({ title: "Example Page", url: "" });
    console.log("Data was shared successfully");
  } catch (err) {
    console.error("Share failed:", err.message);
  }
});

Note that a url of '' refers to the current page URL, just as it would in a link. Any other absolute or relative URL can also be used.

In response to this call to navigator.share() , the user agent would display a picker or chooser dialog, allowing the user to select a target to share this title and the page URL to.

5. Security and privacy considerations

This section is non-normative.

Web Share enables data to be sent from websites to native applications. While this ability is not unique to Web Share, it does come with a number of potential security issues that can vary in severity (depending on the underlying platform).

• There is a requirement to not allow the website to learn which apps are installed, or which app was chosen from navigator.share() , because this information could be used for fingerprinting, as well as leaking details about the user's device.
• Implementors will want to carefully consider what information is revealed in the error message when navigator.share() is rejected. Even distinguishing between the case where no targets are available and user cancellation could reveal information about which apps are installed on the user's device.
• There is a requirement that navigator.share() presents the user with a dialog asking them to select a target application (even if there is only one possible target). This surface serves as a security confirmation, ensuring that websites cannot silently send data to native applications.
• Due to the capabilities of the API surface, navigator.share() is available only in secure contexts (such as https:// schemes).
• Use of navigator.share() from a private browsing mode might leak private data to a third-party application that does not respect the user's privacy setting. User agents could present additional warnings or disable the feature entirely when in a private browsing mode, but this is not mandated as the chooser UI could be considered sufficient warning.
• The data passed to navigator.share() might be used to exploit buffer overflow or other remote code execution vulnerabilities in native applications that receive shares. There is no general way to guard against this, but implementors will want to be aware that it is a possibility.
• To protect users from unsandboxed code execution, user agents may need to block executable files from being shared if share targets on a given platform are known to execute the shared files.