Bug Bounty Reports
Hardcoded credentials
Disclosure of all uploads via hardcoded api secret
-
WebView
Android security checklist: WebView
-
Insecure deeplinks
Account Takeover Via DeepLink
-
Sensitive information disclosure
-
RCE/ACE
Why dynamic code loading could be dangerous for your apps: a Google example
-
RCE in TinyCards for Android
TinyCards made this report private
Persistent arbitrary code execution in Android's Google Play Core Library
Details, explanation and the PoC
CVE-2020-8913: Persistent arbitrary code execution in Google Play Core library
CVE-2020-8913
TikTok: three persistent arbitrary code executions and one theft of arbitrary files
Oversecured detects dangerous vulnerabilities in TikTok
Memory corruption
Exploiting memory corruption vulnerabilities on Android
Includes PayPal example
Cryptography
Use cryptography in mobile apps the right way
-
SQL Injection
SQL Injection in Content Provider
-
Another SQL Injection in Content Provider
-
Session theft
Steal user session
-
Steal files
Android security checklist: theft of arbitrary files
-
How to exploit insecure WebResourceResponse configurations
Includes Amazon apps example
Vulnerable to local file steal, Javascript injection, Open redirect
-
Token leakage due to stolen files via unprotected Activity
-
Steal files due to exported services
-
Steal files due to unprotected exported Activity
-
Steal files due to insecure data storage
-
Insecure local data storage, makes it easy to steal files
-
Bypasses
Accidental $70k Google Pixel Lock Screen Bypass
-
Golden techniques to bypass host validations
-
Two-factor authentication bypass due to vuln endpoint
-
Another endpoint Auth bypass
-
Bypass PIN/Fingerprint lock
-
Bypass lock protection
-
Bypass of biometrics security functionality
-
XSS
HTML Injection in BatterySaveArticleRenderer WebView
-
XSS via SAMLAuthActivity
-
XSS in ImageViewerActivity
-
XSS via start ContentActivity
-
XSS on Owncloud webview
-
Privilege Escalation
20 Security Issues Found in Xiaomi Devices
-
Discovering vendor-specific vulnerabilities in Android
-
Common mistakes when using permissions in Android
-
Two weeks of securing Samsung devices: Part 2
-
Two weeks of securing Samsung devices: Part 1
-
Intent Spoofing
-
Access of some not exported content providers
-
Access protected components via intent
-
Fragment injection
-
Javascript injection
-
CSRF
Deeplink leads to CSRF in follow action
-
Case sensitive account collisions
overwrite account associated with email via android application
-
Intercept Broadcasts
Possible to intercept broadcasts about file uploads
-
Vulnerable exported broadcast reciever
-
View every network request response's information
-
Critical LFI vulnerability in Content Provider
Content Provider Local File Inclusion
-
Last updated