>A properly designed Web wrapper uses techniques to avoid this risk: filtering urls to stay in the app's domain So you are saying the WebView on Android is uns

>A properly designed Web wrapper uses techniques to avoid this risk: filtering urls to stay in the app's domain So you are saying the WebView on Android is unsafe to use for rendering untrusted content. That's a pretty serious limitation and certainly not made clear in the documentation[1]. Infact the first line of the docs suggest that a WebView is suitable to "roll your own web browser" with… Something is seriously wrong with Google's attitude to security if they are happy to document a class that's totally unsafe for use with untrusted data as being safe. Knowing this is enough to put me off ever using Android again to be honest. https://developer.android.com/reference/android/webkit/WebView.html https://developer.android.com/reference/android/webkit/WebVi...