A CSRF attack can only happen when cookies (or other authentication mechanisms) are provided by the client automatically. That is, where the client has access to cookies from multiple domains (such as a web browser storing cookies for each site you visit).
However, a mobile app containing a web viewer will typically only have the cookies for its own system. The cookies will not be shared with other applications using the same web viewer control. Anything loaded from the filing system will also be isolated from each other: Android and iOS have security controls so that apps can't read other app's data. Therefore CSRF is not likely within a mobile application.