I wrote a comment[0] about this in one of the other threads on this topic, but it bears repeating. Apple started working on a solution to this problem in 2020,

I wrote a comment[0] about this in one of the other threads on this topic, but it bears repeating. Apple started working on a solution to this problem in 2020, called App-Bound Domains[2]. I always expected them to make this mandatory instead of opt in eventually. In response to this recent focus on in app browser they could accelerate such a timeline. With mandatory App-Bound Domains, an app would have to list the set of domains it wants to inject JS into in the app manifest. Further, those capabilities are only available after the web view has been restricted to forbid navigation away from the app bound domains. TL;DR: Apple could fix this tomorrow if they wish. 0: https://news.ycombinator.com/item?id=32523474 https://news.ycombinator.com/item?id=32523474 1: https://news.ycombinator.com/item?id=32514793 https://news.ycombinator.com/item?id=32514793 2: https://webkit.org/blog/10882/app-bound-domains/ https://webkit.org/blog/10882/app-bound-domains/