CSRF in Mobile Applications
Will a cookie on Alice's mobile device from a native (or hybrid) application be vulnerable to manipulation, or are these cookies typically sand boxed on the device somehow?
A CSRF attack involves one application: the browser. Your proposed attack involves two separate applications: the banking app and the browser.
Generally speaking, separate applications are separate. Safari does not share data with Firefox, even if both are installed on the same OS X machine. Now, there could be bugs in one or the other that might allow JS to have unfettered access to the OS filesystem and therefore allow a web site in Safari to access Firefox's data (or vice versa), but this is not really related to a CSRF.
The same thing holds for any separate applications, on any modern OS.
Even something such as creating a cookie in JavaScript and then using PhoneGap or Titanium could be relevant I believe.
Not really, any more than Safari having cookies and Firefox having cookies are somehow tied.
it is in fact possible to CSRF an application
You are welcome to provide evidence of your claims, or provide your personal definition of CSRF that would encompass scenarios like Safari attacking Firefox.
As an example, Shared Preferences in Android are sand boxed to prevent other applications from accessing the values.
Correct. This has little to do with CSRF.
In the case of Android, it does seem that how you create and store the cookies does matter in the attack and it can have vulnerabilities.
Again, you are welcome to provide evidence of your claims, or provide your personal definition of CSRF that would encompass scenarios like Safari attacking Firefox.
although physical access to the device leads to a security concern
Having teleporter technology, that would allow a CSRF to cause a mobile device to physically change its location and therefore have an impact on physical access, has yet to be developed.
Web browsers and apps do not share the same cookie store, so CSRF attacks in this manner shouldn't be possible. Apps can also use a web view, but each web view has its own cookie store [1], so a CSRF attack between two apps is also not possible.
From reading this [2], it does look like it is possible to store cookies on the file system which could be used as attack vector via another app, but not via a web browser.
[2] http://developer.android.com/reference/android/webkit/CookieManager.html