While browsing in Webview, you’re vulnerable to a Universal Cross-Site Scripting (UXSS) attack. This means that if you happen to click on a malicious link, an attacker can execute any malicious code he or she wants through JavaScript – completely bypassing the security mechanisms that usually protect you. The attacker can use this vulnerability to automatically install any app they want onto your device.

Google has no plans to patch this vulnerability in Android 4.3 or lower. The best way to avoid being a target is to upgrade to the latest version of Android as soon as you can or to avoid surfing through Webview by opening up links in a secure browser like Chrome, Firefox, or Dolphin.