WebView lets you reuse web assets inside a native shell—fast for MVPs but risky if you load arbitrary URLs, expose broad JS bridges, or mix cleartext traffic. Treat the WebView as a browser surface with its own patch cycle.

Hardening checklist

  • Restrict `loadUrl` to HTTPS origins you control or explicitly trust; avoid `setAllowUniversalAccessFromFileURLs`.
  • Gate `@JavascriptInterface` methods with authentication and payload validation; never expose file or settings access blindly.
  • Enable safe browsing where appropriate, keep Android System WebView updated, and test on MDM-managed devices your enterprise clients use.

Kotlin-native screens plus a thin WebView for long-form help or billing can beat a full Cordova-style shell when performance and store policy scrutiny rise.