The xdc file is just a zip file with a website. There is no sandbox at that level. The javascript can go crazy. If you just display on a webview, it has full permissions to render anything, since the view is equivalent to an iFrame, which has some protections to avoid mixing data between websites but it is not a sandbox. There is a lot that can go wrong, especially if the host app is vibecoded, which all of the ones you mentioned are these days.