Native apps have exposure via the OS, imported modules, network

Web apps have exposure to the same, plus the product of browsers and extension combinations they support.