The HTML files does not have any permission to access anything on the file system. Ideally the whole app will be running inside a sandbox on desktop, for mobile apps this will be the default anyway.