Regarding security: I think this is already managed in the iOS/Android ecosystem. It shouldn't be too difficult to restrict permissions from sites, and has the advantage of possibly allowing accesses for sites you trust.
Regardling difficulty: HTML/CSS is essentially already cross platform UI toolkit. Yes its hard, but Im saying if one were to make it, I dont see why the same UI framework shouldnt work for a desktop application.
Regardling difficulty: HTML/CSS is essentially already cross platform UI toolkit. Yes its hard, but Im saying if one were to make it, I dont see why the same UI framework shouldnt work for a desktop application.