correct me if I am wrong, but the only thing that setAllowFileAccess does is to allow you to load file urls in the webview. Further than that the js code running in this file won't be able to access anything else due to cross side origin issue. What you describe probably stands when allowing universal access from file urls ;)