# Google Photos : Theft of Database & Arbitrary Files Android Vulnerability

Exported HostPhotoPagerActivity in Google Photos accepted file:// URIs without validation, letting a malicious app exfiltrate the app's database and sandbox files via the share sheet.

- Payout: $1,337
- Severity: high
- Program: Google
- Credited: Rahul Kankrale
- Disclosed: 2021-04-13
- Write-up quality: 6/10
- Original: https://servicenger.com/blog/mobile/google-photos-theft-of-database-arbitrary-files-android-vulnerability/
- Library page: https://bugbountylibrary.com/r/blog%3Aservicenger-com-blog-mobile-google-photos-theft-of-database-arbitrary-files-android-vulnerability
- Tags: domain:mobile impact:data-leak impact:dos kind:bounty platform:blog sev:high tech:android technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Android app exported activity (com.google.android.apps.photos.pager.HostPhotoPagerActivity)
**Root cause:** The activity is exported and its intent filter supports the file scheme, so it accepts file:// URIs pointing at app-private sandbox paths without validating caller access.
**Steps:**
1. Build an APK that sends an intent with `setClassName("com.google.android.apps.photos", "com.google.android.apps.photos.pager.HostPhotoPagerActivity")`, `setDataAndType(Uri.parse("file:///data/data/com.google.android.apps.photos/databases/gphotos0.db"), "image/*")`, action `android.intent.action.SEND`.
2. Launch the intent; Google Photos renders a media preview of the file.
3. Tap Share, open the share sheet, select the attacker app (prioritized via `android:label` trick in its intent-filter).
4. Attacker app receives the database file; alternatively choose email to attach the file renamed to image.jpg.
**How found:** Researcher inspected the exported activity and its intent filter, noticed file scheme support, and hypothesized that file:// URIs bypass access validation.
**Exploitation:** A malicious installed app triggers the exported activity with a file:// URI to the victim app's private database, then social-engineers the user into sharing it back to the attacker app via the share sheet, exfiltrating gphotos0.db (remote media, envelopes, backup, local media).
**Escalation:** Sharing to Google contacts in the conversation module crashes with IllegalArgumentException, causing permanent DoS of the conversation module.
**Insight:** Exported Android activities with broad intent filters (file scheme, image/*) can be abused as a confused-deputy to read app-private sandbox files; check exported components' data scheme handling and whether the share-back flow returns the file to a caller-controlled app.