A WebView using unrestricted JavaScript mode exposes loaded content to full script execution and local access.
Disable JavaScript unless required, restrict file access, and load only trusted content.