# Launching Internal & Non-Exported Deeplinks On Facebook

FbMainTabActivity accepted unvalidated rum_destination_uri extras, letting a malicious app attach a music bar that launches internal/non-exported Facebook deeplinks.

- Payout: $4,000
- Severity: high
- Program: Meta / Facebook
- Credited: Ashley King, Rahul Kankrale
- Disclosed: 2021-01-28
- Write-up quality: 7/10
- Original: https://ash-king.co.uk/blog/Launching-internal-non-exported-deeplinks-on-Facebook
- Library page: https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-blog-launching-internal-non-exported-deeplinks-on-facebook
- Tags: domain:mobile impact:ato impact:integrity kind:bounty platform:blog sev:high tech:android technique:chained technique:source-review vuln:access-control vuln:xss

**Target:** Android activity com.facebook.katana.activity.FbMainTabActivity (FB4a)
**Root cause:** handleNewIntent trusted attacker-supplied extras (should_show_rum_player=true, rum_destination_uri, FLAG_ACTIVITY_NEW_TASK) and passed rum_destination_uri to deeplink handling without validation, bypassing deeplink restrictions.
**Steps:**
1. Install attacker APK Fb_PoC on device with FB4a authenticated.
2. Launch Fb_PoC, which starts FbMainTabActivity with extras `should_show_rum_player=true`, `rum_destination_uri=<internal deeplink>`, and flag `FLAG_ACTIVITY_NEW_TASK`.
3. Facebook opens with a music bar attached at the bottom.
4. User taps the music bar; the attacker-controlled internal/non-exported deeplink is launched.
**How found:** Code review of FbMainTabActivity.handleNewIntent revealed the rum player extras were consumed without validation of rum_destination_uri; researchers then searched for internal deeplinks to chain.
**Exploitation:** Malicious app launches FbMainTabActivity with crafted extras to render a music bar; tapping it opens an arbitrary internal deeplink on behalf of the user, enabling CSRF-style actions like de-anonymization or chaining to XSS-vulnerable internal deeplinks in a WebView.
**Escalation:** Chained the deeplink launch to two internal deeplinks vulnerable to XSS, achieving arbitrary JavaScript execution in a FB4a WebView; also enables phishing via URL-hiding WebView override.
**Insight:** Look for exported activities that accept extras controlling navigation/deeplink URIs without validation; a benign-looking UI feature (music bar) can be an arbitrary deeplink launcher bypassing deeplink allowlists.