Jan 13, 20263 min
My First Android 0-day at Samsung S25, Later Used in Pwn2Own
An exported WebView in Samsung's Smart Touch Call takes its URL and HTTP method straight from the intent. Two checks stand in front of it and neither looks at the URL. Samsung closed it as a duplicate; Interrupt Labs took the same entry point to camera and location at Pwn2Own.
AndroidDeep linksPwn2ownSamsungWebView