diff --git a/java/ql/src/Security/CWE/CWE-295/ImproperWebViewCertificateValidation.qhelp b/java/ql/src/Security/CWE/CWE-295/ImproperWebViewCertificateValidation.qhelp
index 8fb725ff082..2a8d3b58a4c 100644
--- a/java/ql/src/Security/CWE/CWE-295/ImproperWebViewCertificateValidation.qhelp
+++ b/java/ql/src/Security/CWE/CWE-295/ImproperWebViewCertificateValidation.qhelp
@@ -39,5 +39,8 @@ In the second (good) example, only certificates signed by a certain public key a
 </example>
 
 <references>
+<li>
+<a href="https://developer.android.com/reference/android/webkit/WebViewClient?hl=en#onReceivedSslError(android.webkit.WebView,%20android.webkit.SslErrorHandler,%20android.net.http.SslError)">WebViewClient.onReceivedSslError documentation</a>.
+</li>
 </references>
 </qhelp>