For those who have no idea what I’m talking about, see Bringing E2E privacy to the Web: 4th security audit 😅 - Delta Chat.
There is addDocumentStartJavaScript, which has been tried in:
In the end we consider that didn’t work out, because a malicious app can access the RTCPeerConnection constructor through iframe.contentWindow.RTCPeerConnection. @adbenitez tried to block all ways to access child iframes’ window objects, but I consider that it would not be reliable.
<firame sandbox without allow-same-origin for the main app frame has also been considered, but it blocks localStorage and stuff.
WebRTC claims yet another person’s weekend.
Edit: my post might have given an impression that WebRTC is not blocked on Android, but it is, with the mentioned “RTCPeerConnection 500 pool exhaustion” hack, which we’d like to get rid of because it’s slow.