why do you think you control that? apple tries, and even then people already managed to run code via pdf engines; on android it's at least more clear you have

why do you think you control that? apple tries, and even then people already managed to run code via pdf engines; on android it's at least more clear you have no control. You probably have apps in your phone runnig rigth now that ship with their own JS engine for advertising purposes. Do you expect them to have all the necessary safeguards?