Oct 18, 20268 min
A 1-Click account takeover in a Crypto app
A single tapped link hands the attacker JavaScript execution under the origin https://www.exchange.example inside the app's own authenticated in-app WebView lead to spoof origin and reads the cleartext session token localStorage.key_account_token() to attacker server
Account takeoverAndroidHermesReactnativeWebView