What does Android's network_security_config.xml "cleartextTrafficPermitted" attribute control, and what is the secure default for apps targeting Android 9+?

• A.The attribute applies to the whole device rather than to one app, and setting it to false blocks cleartext for every installed package (the platform reads the first configuration it parses at boot); a single app can disable HTTP across the handset: the secure default from Android 9 onward is false for all packages.
• B.The attribute governs WebView-loaded URLs alone, and it never reaches OkHttp or HttpURLConnection (the framework applies it inside the WebKit bridge, with library traffic evaluated separately); the secure default from Android 9 onward is false for the WebView, and a developer has to add an interceptor for every other client: the setting covers one surface.
• C."cleartextTrafficPermitted" controls whether the app is allowed to make plaintext HTTP connections; for apps targeting Android 9 (API 28) and above the secure default is false, blocking all cleartext HTTP, ws://, and FTP connections unless explicitly allowed.