Certain HTML5 apps that run across platforms can carry JavaScript attack codes that your smartphone will happily execute. Christopher Intagliata reports