Allow access to camera, geolocation, other Web APIs

Those “powerful” features would exist inside the sandbox. And the sandbox doesn’t allow apps to “phone home” at all.

So what is the fear? You’re afraid that Delta Chat put a back door in their webxdc sandbox?