I just love exploring security vulnerabilities and hacking things.
Bug Bounty: HackerOne Ranked #2 | Bugrap Ranked #6 | Cybozu Ranked #8
CVES: CVE-2025-15569, CVE-2026-2974
Unauthorized Device Command and Control
The exported activity lacked caller validation, permission checks, and input sanitization, allowing any application to pass attacker-controlled data into the AI pipeline and trigger sensitive device-control operations through a privileged backend.
Arbitrary Content and URL Injection in Paypal via Deeplink
A content spoofing vulnerability exists due to unsanitized parameters, allowing in Arbitrary Text and URL injection in Paypal Android.
Arbitrary File Write and File Overwrite via Exposed JSBridge in Bing Android
The Bing Android application allows attacker-controlled URLs to be loaded via a deeplink into a WebView that exposes a JavaScript bridge to the loaded page.
Scam Shield Logic Flaw Enables Phishing Alert Spoofing for Any Sender ID or Number
A flaw in the Redacted app’s Scam Shield allows external Intents to trigger fake phishing alerts, letting malicious application or crafted deeplinks falsely flag legitimate sender IDs or phone numbers.
DOM-Based JavaScript Execution in Xiaomi Browser Reader Mode via <title> HTML Injection (Android)
A DOM-based Cross-Site Scripting (XSS) vulnerability was discovered in Xiaomi Browser’s Read Mode due to insufficient sanitization of the HTML tag, allowing arbitrary HTML or JavaScript to be executed via innerHTML.
Referrer Data Leakage in Facebook via Unvalidated data_uri Parameter
An open redirect vulnerability was discovered in Facebook’s Privacy Checkup endpoint due to the ?back_uri= parameter being processed without any security filtering, allowing attackers to redirect users to malicious website.
Linkshim Bypassed in Facebook Push Notication via Double URL Encoding
A persistent open redirect vulnerability was discovered in Facebook’s Push Notification endpoint due to improper validation of the ?ref= parameter, allowing attackers to redirect users to malicious sites and potentially facilitate phishing attacks.
Cross-Site Scripting in Opera Browser Reader Mode via Malicious <title> Tag (Android)
A reflected Cross-Site Scripting (XSS) vulnerability was discovered in Opera Browser for Android’s Reader Mode due to insufficient sanitization of the HTML tag, allowing attackers to execute arbitrary JavaScript, steal sensitive data, or inject malicious content
Hacking Staysafe Philippines Contact Tracing Platform
Description During the pandemic, I found vulnerabilities in the StaySafe Android application: a user location disclosure issue, a full account takeover via access token, and admin panel access exposing millions of users’ PII. When a user goes to the StaySafe website to create an account or log in, I chose to log in with my Facebook account. After authenticating with Facebook, I noticed it redirected to StaySafe with an endpoint like this: ...
Journey
Hello World