A (malicious) user is able to use safari pinch gestures to go to a new tab. (Not possible in web app mode)