I see, thanks for the background Anton. I haven't used WebView in my own app (partly because it's security sensitive) so didn't realise how integrated the control is! That's indeed a very impressive level of integration.
It's possible I'm over-thinking this. Disabling JavaScript is probably enough to satisfy many use cases with acceptable levels of security. Alternatively, occasionally I look around for a pure-Java HTML/CSS rendering engine. But most of the ones I've found are quite primitive.
