(THIS CODING RULE OR GUIDELINE IS UNDER CONSTRUCTION)

Allowing web apps to use JavaScript leaves the app vulnerable to scripting attacks such as cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.  By default, JavaScript is disabled in WebView.  However, it is possible to enable it by using the method addJavascriptInterface(Object, String) from the android.webkit.WebView class. Doing so is dangerous. Sensitive or personal data should not be exposed to a JavaScript interface. Also, code received via such an interface cannot be trusted and it could corrupt the network or server.

...