Honestly, this is pretty sloppy and Google should know better. I've done a lot of work with WebView on Android and it's a straightforward process to intercept

Honestly, this is pretty sloppy and Google should know better. I've done a lot of work with WebView on Android and it's a straightforward process to intercept requests to whitelist domains. It's well trodden ground [1], especially for apps that use the WebView for their entire UI. This is an oversight by everyone from the dev team to the product manager to the QA working on it. 1. https://blog.oversecured.com/Android-security-checklist-webview/ https://blog.oversecured.com/Android-security-checklist-webv...