I think this is what's happening:
When ViewController.xib is loaded, an instance of UIWebView is allocated and initialized. Since you're not wiring it up anywhere, it's not getting released. I think you need to wire it up and release it in your backing View Controller's dealloc function. I remember having to manually release every object I created in a xib file.
Are you running Leaks on the Simulator? If so, caveat coder. The Simulator will leak memory where the iPhone hardware won't. No simulator is ever a perfect match for the exact behavior of your code on the device.
I would test on the device as well. I just did the same thing on a similar issue with UITableViewController which was leaking in the Sim but not on the phone.
I was also having trouble with leaks from NSData's dataWithContentsOfURL: in the iPhone simulator. I found that when I used the other convenience method (dataWithContentsOfURL:options:error:) I would not get the memory leak.
My code looked something like this:
NSURL *url = [NSURL URLWithString:urlString];
NSError *error = nil;
NSData *data = [NSData dataWithContentsOfURL:url
options:0
error:&error];