I don't believe the iOS sandboxing would allow for V8, though. Isn't this the same problem as "my third party app WebView is slow because it doesn't support Javascript JIT"?

You are right, it wont allow V8. The only app allowed to JIT on iOS 4.3+ is Safari (before 4.3 not even Safari was allowed to modify it's own code).

It is technically part of the Mandatory Code Signing trusted computing implementation of iOS more than of the Sandbox. They use the dirty bit normally used to do Copy on Write to re-verify signatures when dirty executable memory is paged in.

The app store rules talk about "built-in Webkit". Judging from the size, there's a good chance Chrome for Android bundles its own WebKit version.

It's similar in size to Firefox, which obviously has to bundle its own Gecko rendering engine.