Abstract: A method including receiving, at an embedded browser embedded in an application, a request to access data designated by a uniform resource locator (URL) specified by the request. The method also includes intercepting, by a method interceptor, an application programming interface (API) call to access the data designated by the URL. Intercepting is performed prior to execution of the API call. The API call is performable by an API of the embedded browser. The method also includes comparing, by the method interceptor, a domain specified by the URL to an list of allowed domains. The method also includes blocking, by the method interceptor and responsive to the domain failing to be a member of the list of allowed domains, the API call. Blocking is performed by the method interceptor preventing the API call from passing to the API.