# Twitter for android is exposing user's location to any installed android app

Twitter for Android broadcast user GPS location via an unprotected implicit broadcast, letting any installed app without permissions silently track the user's location.

- Payout: $560
- Severity: low
- Program: X / xAI
- Credited: mishre
- Disclosed: 2017-01-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/185862
- Library page: https://bugbountylibrary.com/r/h1%3A185862
- Tags: domain:mobile impact:pii-leak kind:bounty platform:hackerone sev:low tech:android technique:reverse-engineering vuln:info-disclosure

**Target:** Android app implicit broadcast (com.twitter.library.geo.LOCATION_CHANGED)
**Root cause:** App sent location via `sendBroadcast` with an implicit action and no receiver permission, so any installed app registering for the action receives the coordinates.
**Steps:**
1. Decompile Twitter for Android and locate `sendBroadcast` of `com.twitter.library.geo.LOCATION_CHANGED` with extra `com.twitter.library.geo.LOCATION_EXTRA`
2. Build a malicious app with no permissions that registers a BroadcastReceiver for that action
3. Install both apps; grant Twitter location permission and trigger location use
4. Malicious app receives coordinates whenever Twitter broadcasts them
**How found:** Researcher inspected Twitter's Android code and noticed location was forwarded via an unprotected implicit broadcast, then built a no-permission PoC app to confirm.
**Exploitation:** Any installed app registers a receiver for the implicit broadcast action and passively harvests GPS coordinates each time Twitter obtains a location fix, with zero permissions requested.
**Insight:** On Android, grep decompiled apps for `sendBroadcast` with implicit action strings carrying sensitive extras; implicit broadcasts are world-readable unless a receiver permission is set.