Hacker News Reader

Not really - Android has for many versions now been updating the embedded webview component via play services.

Huh, that's somewhat comforting, I guess. And all image codecs etc. are statically linked?

Many are. However, you'd still be vulnerable via API calls to other things, like Binder exploits.