We've recently made some modifications to the app architecture and build which has caused an issue on Android in which the WebView is no longer able to access files embedded in the app package. As a temporary workaround we're considering hosting the files on a CDN (probably CloudFront) and loading them in from there.
Would this arrangement be any less secure than accessing the same pages in a browser? It occurs to me that if something caused the app to load the pages from another location (maybe some kind of DNS exploit?) then the affected user could end up with a compromised payment system within what they see as a trusted app.
Is this a risk that should be taken seriously, and if so what measures could/should we take to protect against it?