The app can tell the webview: open this URL. That's pretty much it. Injecting could theoretically happen, but only by showing a page that looks like the origina

The app can tell the webview: open this URL. That's pretty much it. Injecting could theoretically happen, but only by showing a page that looks like the original but isn't.