# Improper Implementation of SDK Allows Universal XSS in Webview Leading to Account Takeover

Exported SurveyMonkey SMFeedbackActivity in Exness Social Trading app loaded attacker-supplied HTML into a JS-enabled WebView, enabling cookie theft and account takeover.

- Payout: hidden
- Severity: low
- Program: EXNESS
- Found by: holyfield
- Disclosed: 2022-04-13
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1455987
- Library page: https://bugbountylibrary.com/r/h1%3A1455987
- Tags: area:web3 domain:mobile impact:ato impact:data-leak kind:bounty platform:hackerone sev:low tech:android technique:source-review vuln:access-control vuln:account-takeover vuln:xss

**Target:** Android app com.exness.investments (SurveyMonkey SDK SMFeedbackActivity WebView)
**Root cause:** The SurveyMonkey SDK's SMFeedbackActivity is exported and passes attacker-controlled intent extras smSPageHTML/smSPageURL into WebView.loadDataWithBaseURL() with JavaScript enabled, so HTML runs in the origin of the supplied baseURL.
**Steps:**
1. Install com.exness.investments 2.45.8-release.
2. Build attacker app that starts Exness launch intent, then fires an explicit intent to com.surveymonkey.surveymonkeyandroidsdk.SMFeedbackActivity with extras `smSPageHTML=<script>document.write(document.cookie)</script>` and `smSPageURL=https://my.exness.asia/r/`.
3. Launch attacker app; after delay the exported activity loads the payload in a JS-enabled WebView under the my.exness.asia origin.
4. Observe victim cookies/JWT rendered, demonstrating theft across all WebView-stored cookies.
**How found:** Researcher inspected the app's AndroidManifest and decompiled SurveyMonkey SDK code, noticed SMFeedbackActivity exported despite SDK docs expecting programmatic init, then traced intent extras into loadDataWithBaseURL() with setJavaScriptEnabled(true).
**Exploitation:** Malicious app on the device launches the exported SMFeedbackActivity with crafted extras; the WebView executes attacker JS in the context of the supplied baseURL, exfiltrating cookies/JWT for any site the victim logged into via Exness WebViews, enabling account takeover, position manipulation and withdrawals.
**Escalation:** Single cookie store shared across all app WebViews means one payload harvests credentials for every logged-in site, escalating to full account takeover and fund withdrawal.
**Insight:** Third-party SDK activities merged into an app's manifest can be exported by default; grep decompiled manifests for SDK activity names and trace their intent extras into WebView loaders like loadDataWithBaseURL, which inherit the baseURL origin.