In the past, WebView was tightly coupled with the operating system and the component would only be updated with the release of a new version of the operating system. When Google released Android 5, however, Google separated WebView from the core operating system so updates to WebView can be distributed through the Google Play app store. This is good news for end users whose Android devices run newer versions of the operating system. If a bug is found in the WebView component, Google can push out a fix and end users can get it at the Google Play store and install it.
Google no longer provides patches for vulnerabilities found in Android versions 4.3 and older, however. To protect devices from attacks that might exploit WebView's capabilities, Google recommends that all Android users run the latest version of the operating system and update WebView when prompted.