Is the HTML5 application loaded in a mobile browser or using WebView Canvas. Browsers acts as a sandbox, but an HTML 5 App opened using WebView no longer has the same security, but it can be made most secure by following some of the guidelines listed in the link below.
Some of the highlights:
- All the pages you load in the webview should be from a source you
agree to trust. So loading a facebook page or a forum page or
similar page is not secure.
- Only load trusted page in webview. For
all others open in web browser
- Make sure the HTML 5 app has minimal
permissions (don't allow access to camera or contacts in the phone
unless absolutely needed).
- Don't load a any page in your app which
has advertisements unless you are willing to trust them, which I
think you should not for an app which accepts payment. Even if the
ad was served on one of your previous page and not on the payment
page (enter credit cards), the WebView model in Android and iPhone
allows access across content of multiple pages...(see the link for
Bottomline: The app should only load pages in webview which you absolutely trust.
I check the PCI compliance docs, there is no current explicit guidelines for how to accept PCI data in a Mobile application and they are working on creating a guidelines for it (as of Dec, 2011). Until then, follow as much of PCI guidelines as possible like never store private data on the phone and others.
I hope the above was helpful. I have been searching doe PCI compliance guideline for HTML 5 app opened in WebView for the last 3-4 days.