Hacker News Reader

In 2017, there was a remote exploit via the browser:

Fortunately, this was patched. Not sure if there are newer ones

It's worth noting browser updates aren't tied to manufacturer's updates.

The majority of Android devices will have updated Chrome and web view soon after the Chrome team released a fix.

in V8 in Google Chrome

Not surprisingly, it's another JS one.

I use JS whitelisting not only on my PCs for that reason.