For FirefoxOS &quot;hosted&quot; apps this is true, but they also don&#x27;t have access to any significant APIs. Only &quot;packaged&quot; apps do.<p>This is also not true for add-ons (for desktop&#x2F;mobile or FirefoxOS), these are packaged as zip files and can&#x27;t be arbitrarily changed.<p>However, there is the problem however of the app or add-on downloading and running code from the internet unchecked, which is probably intractable to do in an automated way (at least for the current APIs exposed, and for a dynamic language like JS), manual review is required.<p>Mozilla requires manual review, and Apple disallows interpreters. I&#x27;m not sure what if anything Google does about this problem for Android.