diff --git a/app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java b/app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java
index 5dc7fdc952..7f18ff5500 100644
--- a/app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java
+++ b/app/src/main/java/com/alphawallet/app/web3/Web3TokenView.java
@@ -379,7 +379,11 @@ public boolean shouldOverrideUrlLoading(WebView view, WebResourceRequest request
         public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error)
         {
             System.out.println("YOLESS: " + error.toString());
-            handler.proceed(); // Ignore SSL certificate errors
+            // Security fix: reject invalid SSL certificates by default.
+            // handler.proceed() was removed to prevent accepting untrusted certificates.
+            // For development/testing with self-signed certs, consider using
+            // network_security_config.xml instead.
+            handler.cancel(); // Ignore SSL certificate errors
         }
     }
 
diff --git a/app/src/main/java/com/alphawallet/app/web3/Web3View.java b/app/src/main/java/com/alphawallet/app/web3/Web3View.java
index f2f6383435..bb34816f6e 100644
--- a/app/src/main/java/com/alphawallet/app/web3/Web3View.java
+++ b/app/src/main/java/com/alphawallet/app/web3/Web3View.java
@@ -15,6 +15,7 @@
 import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
 import androidx.webkit.WebSettingsCompat;
+import androidx.webkit.WebViewCompat;
 import androidx.webkit.WebViewFeature;
 
 import com.alphawallet.app.BuildConfig;
@@ -31,8 +32,11 @@
 import org.jetbrains.annotations.Contract;
 import org.jetbrains.annotations.NotNull;
 
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Map;
+import java.util.Set;
 
 import timber.log.Timber;
 
@@ -206,6 +210,16 @@ public void init()
         {
             WebSettingsCompat.setAlgorithmicDarkeningAllowed(getSettings(), true);
         }
+
+        // Inject Web3 provider at document start so window.ethereum is available
+        // before any page scripts run. This fixes CSP timing issues where sites
+        // like exchange.idex.io fail to detect the provider.
+        if (WebViewFeature.isFeatureSupported(WebViewFeature.DOCUMENT_START_SCRIPT))
+        {
+            String providerJs = webViewClient.getJsInjectorClient().providerJs(getContext());
+            Set<String> origins = new HashSet<>(Collections.singletonList("*"));
+            WebViewCompat.addDocumentStartJavaScript(this, providerJs, origins);
+        }
     }
 
     @Nullable