# MetaMask Browser (on Android) does not enforce Content-Security-Policy header

MetaMask Android in-app browser ignored Content-Security-Policy response headers, letting XSS payloads execute and drive wallet transactions despite script-src 'none'.

- Payout: hidden
- Severity: medium
- Program: MetaMask
- Found by: renniepak
- Disclosed: 2024-08-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1941767
- Library page: https://bugbountylibrary.com/r/h1%3A1941767
- Tags: area:web3 domain:mobile impact:funds-loss impact:integrity kind:bounty platform:hackerone sev:medium tech:android technique:source-review vuln:misconfiguration vuln:xss

**Target:** MetaMask Mobile in-app browser (io.metamask, Android v6.1.1)
**Root cause:** The app's web request handling, modified to avoid blocking the injected MetaMask JS provider, stripped/ignored Content-Security-Policy response headers. CSP via <meta> tag was still enforced.
**Steps:**
1. Install MetaMask v6.1.1 (1079) Android, create wallet.
2. Serve page with `Content-Security-Policy: script-src 'none'` header plus `<script>alert(1)</script>`; open in MetaMask browser — script executes.
3. Compare with same CSP in `<meta http-equiv>` — blocked, confirming header-specific bypass.
4. Serve page with header CSP plus web3.js payload calling `window.ethereum.enable()` then `web3.eth.sendTransaction` draining balance to attacker address; transaction initiates.
**How found:** Researcher had an HTML injection on a site with strict CSP that blocked XSS in normal browsers; opening it in MetaMask Android browser executed the payload. Testing showed <meta> CSP still enforced but header CSP ignored, prompting code review of metamask-mobile for intentional disabling (none found).
**Exploitation:** Attacker needs an XSS on a site the victim visits in MetaMask browser. With CSP header ignored, injected JS runs, calls window.ethereum.enable() (site already connected), reads accounts/balance, and sends a transaction sweeping ETH to attacker address minus gas.
**Escalation:** Chains a benign HTML-injection/XSS on a CSP-protected site into full wallet-draining transaction via injected provider.
**Insight:** In-app/embedded browsers that inject a provider script often relax request interception; test CSP enforcement separately for response headers vs <meta> tags, since a meta-only pass can mask a header bypass.