Security

There are some real complexities using iframes and the postMessage API for communication between a widget and its parent. Security vulnerabilities like cross-origin scripting risks being one.

You should know that in-app browser can and do literally inject JavaScript into the websites you visit with them with tracking scripts from the app you’re inside of. And that’s just one thing that sucks about them.

Polyfill.io recently served malicious code, redirecting users to inappropriate sites. Subresource Integrity (SRI) can help prevent such issues by verifying script integrity.