Replicant

I fail to understand the logic of how replacing free software with proprietary counterparts is any better for privacy/security. Every single piece of proprietary software is a fatal flaw to privacy/security.

Of course, those instructions are not endorsed by Replicant, but you're speaking here on your own name, not on behalf of the project.
However, I would suggest that this is perhaps not the right place to discuss the use of proprietary components, as it is clearly not relevant to Replicant and the values behind it. That said, I won't prevent you from doing it, provided there is nothing misleading.

I fail to understand the logic of how replacing free software with proprietary counterparts is any better for privacy/security. Every single piece of proprietary software is a fatal flaw to privacy/security.

Full acknowledge to this point.

However, there are serious exploits for the vulnerable WebView in the wild, for example: https://github.com/rapid7/metasploit-framework/pull/3759/files
(With this you could provide an open Access Point for example, and inject the exploit on every connection. From now, you're able to take over every active sessions [also HTTPS sessions!] and cookies etc.)

So IMHO I had to choose the lesser of two evils, and using the critically dangerous standard browser is not an option for me anymore.
I've made this post with a heavy heart, but probably somebody other is in the same 'what should I do'-question situation...

Because of this, I'm not that sure about that warning message (out of topic: http://redmine.replicant.us/boards/39/topics/8007).
IMHO it's generally a good idea, but the browser is not the only vulnerable app in this context.
I've seen this: http://www.replicant.us/freedom-privacy-security-issues.php#recommendations
It looks like that the "browser shipped with Replicant" and "Lightning" are the only vulnerable browser targets. That's not correct. Because people could take the next browser found over f-droid (https://github.com/powerpoint45/Lucid-Browser), which is using WebView, too.

One of the main problems are, that there are a lot of apps, which using the vulnerable built-in WebView engine.
Only one more app example: "HN" [checked on version 1.9.10] (https://f-droid.org/repository/browse/?fdfilter=hacker+news&fdid=com.manuelmaly.hn)
UPDATE there is an issue for that on the HN-GitHub-repo: https://github.com/manmal/hn-android/issues/143
The thing is, that you often don't know if the app you want is using this engine in the background; so it's very hard to find that out as a standard user.

Google said to the app developers: "[...] consider providing your own renderer on Android 4.3 and earlier [...]".
Source: https://plus.google.com/+AdrianLudwig/posts/1md7ruEwBLF
So if you consider one of this temporarily (non-free!) workarounds from above, this doesn't solve the problem that other (mostly unknown) apps still using WebView.

IMHO, the best thing what could happen for now, would be a soon release of CM11 M13 (http://forum.cyanogenmod.org/topic/104078-cm11-m13/) and a new Replicant version based on that: http://redmine.replicant.us/boards/33/topics/7665?r=8109. But in the meanwhile I have to figure out a good workaround or better a solution for that bad situation...

Of course, those instructions are not endorsed by Replicant, but you're speaking here on your own name, not on behalf of the project.
However, I would suggest that this is perhaps not the right place to discuss the use of proprietary components, as it is clearly not relevant to Replicant and the values behind it. That said, I won't prevent you from doing it, provided there is nothing misleading.

Of course, and thanks for that clarification to other people.

It looks like that the "browser shipped with Replicant" and "Lightning" are the only vulnerable browser targets.

Come-on, it clearly says "Browsers using the webview framework". That is accurate.

The thing is, that you often don't know if the app you want is using this engine in the background; so it's very hard to find that out as a standard user.

I understand this is a problem, but I have no easy solution. I don't have time to bring Replicant to a new version, and such a security issue is not a sufficient motivation.