An exported Android launcher activity, an attacker-controlled deep link extra, and an unguarded cookie write enabled one-tap session token theft on a major US department store retailer's app.
Apr 9, 2026A hardcoded deep link service key, an unvalidated WebView article handler, and an unauthenticated open redirect on a national mobile carrier's own domain combined to render attacker-controlled login pages inside the official app's chrome with no URL bar.
Apr 9, 2026A server that accepted SVG uploads via its API despite its own UI rejecting them allowed a JavaScript-bearing SVG to be embedded in any report description and silently exfiltrate session data from every viewer, including triage and program managers.
Apr 7, 2026An unsafe downcast silently truncated withdrawal amounts. Any user withdrawing more than ~18 tokens would permanently lose most of their funds with no revert and no recovery path.
Apr 3, 2026A digital file upload endpoint fetched any attacker URL server-side and stored the response. Live AWS temporary credentials pulled from production EC2.
Apr 1, 2026A hardcoded API key inside a smart home camera platform's Android app unlocked unauthenticated account creation, full read-write-delete access to a production storage bucket, mass account lockout, and password-reset email triggering against the entire customer base.
Mar 31, 2026A deep link handler in a ride-hailing Android app accepted attacker-controlled JSON, bypassed its own host allowlist using relative paths, and let any link click book a real ride against the victim's authenticated account.
Mar 31, 2026An exported activity, a data: URI validation bypass, and a JavaScript bridge with no origin check let any zero-permission co-installed app silently steal a 30-day session token from a centralized cryptocurrency exchange's Android app.
Mar 30, 2026A missing domain check in a centralized cryptocurrency exchange's Android WebView wrapper sent the user's full 30-day session token as an HTTP header to a third-party charting domain on every meme coin chart view.
Mar 30, 2026Zero-permission co-installed app silently steals session token in under 5 seconds. Trading, PII, and withdrawal address injection confirmed.
Mar 27, 2026