Mar 27, 2024, 12:05 AM@gabek Thanks for the feedback. Our stance in our paper is that in-app browsers that respect the user's choice of default browser are fine.
We have added the following text to the article to help clarify this:
"Remote tab in-app browsers such as Android Custom Tabs are a potentially ideal solution for most users. Android Custom Tabs by default invokes the user's default browser and prevents the app injecting JavaScript."
Mar 27, 2024, 12:05 AM@gabek "This is an interesting middle ground where the user (and the app) can benefit from not leaving the app context while still respecting the user's choice of default browser and preserving the user's privacy. However, currently it is possible for the hosting Native App to lock Android Custom Tabs to a particular browser and override the user's choice of default browser. This ability needs to be removed."
Mar 27, 2024, 12:05 AM@gabek "While iOS's remote tab in-app browser SFSafariViewController prevents the app injecting JavaScript, it is locked to Safari (or more specifically the WkWebView) and thus overrides the user's choice of default browser."