Read the piece on holovaty.com ↗
Every claim below was made in this piece, quoted word for word and numbered in the order the piece makes them, so you can read it there rather than take our word for it. The sentence above each quote is our reading of the claim, not their wording. Each quote was checked against a stored copy of the page at build time; where the two differ, the quote is the fact.
Their wordsYet native apps (and their mobile operating systems) ignore this header, which is a gaping loophole.
Our reading
Native apps can inject arbitrary JavaScript into any website viewed within their webviews.
Their wordsWhen a native app embeds a website via a webview, the native app has control over that page. Yes, even if it's on a domain that the native app doesn't control (!). This means the native app can inject whatever JavaScript it likes into any website that's viewed in the webview.
Their wordsI can't imagine a general opt-out solution that doesn't involve iOS and Android providing hooks at the OS level.
Keep reading
The other pieces are the ones whose claims are worded most like this one's. That measures language, not agreement: they may argue the opposite.