res/xml/network_security_config.xml

<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright 2018 The Chromium Authors. All rights reserved.
     Use of this source code is governed by a BSD-style license that can be
     found in the LICENSE file. -->

<network-security-config>
    <!-- Starting with Android P (API level 28), the default value of
    isCleartextTrafficPermitted() is false. For the SystemWebViewShell
    test browser we explicitly set cleartextTrafficPermitted here to
    preserve functionality. (crbug.com/898190) -->
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="user"/>
            <certificates src="system"/>
        </trust-anchors>
    </base-config>
</network-security-config>