# Facebook android webview vulnerability : Execute arbitrary javascript (xss) and load arbitrary website

Exported Facebook Android activity LaunchFromIAP loaded CHECKOUTURL intent extra into WebView without scheme validation, allowing javascript: URL XSS and arbitrary site loading.

- Payout: $1,075
- Severity: medium
- Program: Meta / Facebook
- Credited: Rahul Kankrale
- Disclosed: 2022-01-03
- Write-up quality: 6/10
- Original: https://servicenger.com/mobile/facebook-android-webview-vulnerability/
- Library page: https://bugbountylibrary.com/r/blog%3Aservicenger-com-mobile-facebook-android-webview-vulnerability
- Tags: domain:mobile impact:integrity kind:bounty platform:blog sev:medium tech:android technique:source-review vuln:access-control vuln:xss

**Target:** Android exported activity com.facebook.katana.activity.iap.LaunchFromIAP / WebView
**Root cause:** Exported activity passes CHECKOUTURL intent extra to WebView loadUrl with only http/https validation, and SecureWebView by default handles javascript: URLs.
**Steps:**
1. Identify exported activity com.facebook.katana.activity.iap.LaunchFromIAP via static analysis of app v338.1.0.36.118.
2. Note A0I returns intent extras and CHECKOUTURL is read via getString and passed to WebView.
3. Craft intent: `Intent intent = new Intent("com.facebook.katana.activity.iap"); intent.putExtra("CHECKOUTURL", "javascript:alert(8)"); startActivity(intent);`
4. Or via browser link: `intent:#Intent;action=com.facebook.katana.activity.iap;S.CHECKOUTURL=javascript:alert(8);end`
5. Or explicit class: `intent.setClassName("com.facebook.work", "com.facebook.katana.activity.iap.LaunchFromIAP")` with javascript: payload.
**How found:** Static code analysis of the Facebook APK revealed the exported LaunchFromIAP activity and traced the CHECKOUTURL extra through bundle A0I into WebView loadUrl.
**Exploitation:** Any app or browser link triggers the exported activity with a javascript: or attacker URL in CHECKOUTURL, causing XSS in the Facebook WebView context or loading a phishing page.
**Insight:** Enumerate exported activities in Android apps and trace intent extras into WebView.loadUrl; javascript: scheme acceptance in a WebView wrapper is the exploitable gap even when http/https is nominally checked.