Neil Mark Ochea 🕷

The exported activity lacked caller validation, permission checks, and input sanitization, allowing any application to pass attacker-controlled data into the AI pipeline and trigger sensitive device-control operations through a privileged backend.

A content spoofing vulnerability exists due to unsanitized parameters, allowing in Arbitrary Text and URL injection in Paypal Android.

The Bing Android application allows attacker-controlled URLs to be loaded via a deeplink into a WebView that exposes a JavaScript bridge to the loaded page.

A flaw in the Redacted app’s Scam Shield allows external Intents to trigger fake phishing alerts, letting malicious application or crafted deeplinks falsely flag legitimate sender IDs or phone numbers.

A DOM-based Cross-Site Scripting (XSS) vulnerability was discovered in Xiaomi Browser’s Read Mode due to insufficient sanitization of the HTML tag, allowing arbitrary HTML or JavaScript to be executed via innerHTML.

An open redirect vulnerability was discovered in Facebook’s Privacy Checkup endpoint due to the ?back_uri= parameter being processed without any security filtering, allowing attackers to redirect users to malicious website.

A persistent open redirect vulnerability was discovered in Facebook’s Push Notification endpoint due to improper validation of the ?ref= parameter, allowing attackers to redirect users to malicious sites and potentially facilitate phishing attacks.

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in Opera Browser for Android’s Reader Mode due to insufficient sanitization of the HTML tag, allowing attackers to execute arbitrary JavaScript, steal sensitive data, or inject malicious content

A broken multi-factor authentication vulnerability exists in OKX’s Android application due to an exported launcher Activity, allowing a locally installed malicious application to bypass the fingerprint-based multi-factor authentication check and resume a logged-in session without credentials.

Key points of this writeup Discovered a leaked OAuth token: StaySafe.ph’s Facebook login redirect exposed a long-lived (~59-day) access token directly in the URL. That token alone was enough to impersonate a user, no password required. Reverse-engineered the mobile app: Decompiled ph.staysafe.mobileapp (v2.1) using Jadx and apktool to dig into how the app worked under the hood. Accessed sensitive exposure data: With just the leaked token, pulled detailed contact-tracing logs showing exposure status (Probable, Suspect, Confirmed, Cleared, Initial), color-coded and dated, including full historical records, not just current data. Mapped 20+ exposed API endpoints: Extracted from the app’s JS bundle, covering critical functions like password reset, OTP verification, account activation/deactivation, and account deletion. Found an exposed, editable backend: The Laravel backend source and admin panel were publicly accessible, and editable, leaking massive amounts of PII for millions of users: names, emails, passwords, phone numbers, OTPs, vaccination status, locations, and more. Technical Details During the pandemic, I found vulnerabilities in the StaySafe Android application: a user location disclosure issue, a full account takeover via access token, and admin panel access exposing millions of users’ PII. ...