The app code signing process provides some assurance that the app has not been altered.

https://developer.apple.com/library/mac/documentation/Securi...

edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.

Any software installed on the system can add root CAs to both of them.

This may no longer be true for Chrome at least. They recently added protection against unauthorized configuration changes by third party programs. I'm having trouble determining whether that protection extends to root CAs though.

Chrome, last I checked, mostly relies on the OS list of trusted CAs in OS X and Windows, and brings its own on Linux which uses NSS.