Are there the same restrictions on JavaScript in Android Chrome as that of Windows?
Apps on Android are already containerized in multiple sandboxes, be it a web browser or some other app. There's Linux kernel's robust Discretionary Access Control (DAC); UIDs / GIDs / modes, supplemented by Mandatory Access Control (MAC); SELinux. Every app's Java virtual machine (the native process) runs with its own unique UID and SELinux context. Android also makes use of Linux namespaces, capabilities and seccomp. See Application Sandbox.
In addition to that Android has it's own permission control framework. Access to system resources, devices and filesystems is governed by a long list of manifest permissions like Storage, Camera, Contacts etc. which have different protection levels. See Permissions.
So any further restriction put on apps' internal code (like in JS) provides no significant improvement on Android.
From your comment:
But if all Android apps are sandboxed then how can a person upload a file to a website.
It's achieved through Android's external shared storage which is accessible to apps only after user grants permission.
Concisely, if I grant storage permission to browser X and open a web application Y in that browser, does that mean that Y can also access my media, files etc?
Definitely yes. There's no restriction from OS side. A web application runs inside a web browser. A web browser is an ordinary Android app. When an Android app starts, a native UNIX process is forked which is subject to all DAC, MAC and other restrictions at kernel level. A web application running in the same native process isn't a separate entity. From OS's view, the whole native process is a single unit. So the same restrictions apply to the whole code in that process, whether it's written in Java, JS, C, Python, or any other language.
JavaScript aside, is there any other way for any PWA or web app or website to view the contents of my internal storage without my permission?
Well, we first need to define my and internal storage.
DAC on desktop OSes (at least on Windows and Linuxes) is different than on Android. On desktop OSes files belong to human users. So when you say my files, that means they all are assigned an identifier (UID/GID) which represents a human user. And all programs run by a human user also run with the same UID, so they can access each other's files. That's why additional restrictions (such as JS improvement in Chrome as you mentioned, and Firefox's use of Linux namespaces etc.) are put on programs, particularly those interfacing the internet e.g. web browsers. Also check firejail.
But on Android, it's the apps which are isolated from each other, not human users. Every app is assigned a unique UID/GID and files belong to apps. For more details see my answer to Are multiple-users protected from each other differently than apps?.
Coming to storage, Android stores configurations, apps and data to partition mounted at /data which is not accessible without rooting (Why are superuser permissions needed to acess /data partition?). Apps have their private storage (in /data/data/) which isn't accessible to any other app because every app's directory has its own UID/GID which belongs to its owner app (that's how DAC works).
In order to share files among apps, Android provides a permission-less emulated filesystem called external shared storage. It's a physically internal storage (/data/media directory) accessible at /sdcard/ (primary), or additionally can be a physically external SD card (secondary). External shared storage contains private directories which belong to individual apps. These directories are available to apps without requiring any permission. The rest of the public directories are only accessible to apps which are granted Storage permission (READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE) by the user.
However the filesystem level access to whole /sdcard is very much deprecated in Android 10 and 11 due to its broad nature. Now there are MediaStore and Storage Access Framework (SAF) which provide apps even limited access to files on external shared storage. For more details see my answers to Where Android apps store data?, Android's Storage Journey and What is the "u#_everybody" UID?.
So:
- Access to files created / downloaded by an app in its private storage or private directories in external storage is never restricted.
- Access to the files of other apps in private storage is never possible.
- Access to the files in public external storage or private external storage of other apps is subject to permission granted to the app by the user.
