This seems like a clear cut case of a missing permission: for an app to be allowed to access your interactions with a domain, it should need to either prove it owns the domain, or receive user permission to access the domain. This safely covers the legitimate use cases of punting out some UI to your website and of just providing a way to view websites in-app, while for iffier use cases permitting both informed consent and fallback to displaying the page without handing out access to it.