Note: This only executes if the host app unsafely evals your message; the WebView itself just forwards strings to native.