# Third party app could steal access token as well as protected files using inAppBrowser

Reddit Android's exported RedditDeepLinkActivity passed unvalidated file:// URIs to InAppBrowser, letting any third-party app read protected shared_prefs and steal auth tokens.

- Payout: hidden
- Severity: medium
- Program: Reddit
- Found by: rahulkankrale
- Disclosed: 2021-10-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1122177
- Library page: https://bugbountylibrary.com/r/h1%3A1122177
- Tags: area:mobile domain:mobile impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium tech:android technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Android app exported activity com.reddit.frontpage.RedditDeepLinkActivity / InAppBrowser
**Root cause:** RedditDeepLinkActivity is exported and forwards intent data URIs to InAppBrowser without validating scheme or host, so file:// URIs reach the WebView and load app-private files.
**Steps:**
1. Build a third-party app that fires an explicit intent to `com.reddit.frontpage/com.reddit.frontpage.RedditDeepLinkActivity` with data `file:///data/data/com.reddit.frontpage/shared_prefs/com.reddit.auth_active.<UserName>.xml`.
2. Launch the intent; Reddit opens InAppBrowser rendering the shared_prefs XML containing the auth token.
3. Alternatively run `adb shell am start -n "com.reddit.frontpage/com.reddit.frontpage.RedditDeepLinkActivity" -d "file:///data/data/com.reddit.frontpage/shared_prefs/com.reddit.frontpage_preferences.xml"`.
4. Exfiltrate the rendered file contents (token, cookies, DBs) to an attacker server.
**How found:** Noticed RedditDeepLinkActivity routes deeplinks and reddit.com links but does not check scheme/host, and that InAppBrowser can access app-private files; hypothesized file:// URIs would be loaded.
**Exploitation:** A malicious installed app sends an explicit intent to the exported RedditDeepLinkActivity with a file:// URI pointing at app-private shared_prefs; InAppBrowser loads and displays the file, exposing the auth token and other protected data to the attacker.
**Insight:** On Android, exported deep-link activities that hand URIs to a WebView/InAppBrowser should be tested with file:// and content:// schemes — missing scheme validation turns a router into a local file reader.