They're not so common anymore, largely in part due to focused attention on that attack surface and continual software updates (!) via the playstore - google dec

They're not so common anymore, largely in part due to focused attention on that attack surface and continual software updates (!) via the playstore - google decoupled the webview rendering libraries from the os. Malware such as SpyNote/CypherRat is commonly a sideload attack, but occasionally webview rces have been used to deliver it and others. But as mentioned above, webview malware is rare today, largely in part due to fast patching and updates!