# Access of Android protected components via embedded intent

Exported Slack HomeActivity launched attacker-supplied nested intents, reaching non-exported activities to open arbitrary WebView URLs and spoof calls.

- Payout: hidden
- Severity: critical
- Program: Slack
- Found by: bagipro
- Disclosed: 2017-07-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/200427
- Library page: https://bugbountylibrary.com/r/h1%3A200427
- Tags: area:mobile domain:mobile impact:integrity kind:bounty platform:hackerone sev:critical tech:android technique:source-review vuln:access-control vuln:privilege-escalation

**Target:** Slack Android app exported HomeActivity
**Root cause:** Exported HomeActivity reads a Parcelable Intent extra 'extra_deep_link_intent' from getIntent() and calls startActivity() on it without validation, letting any app launch non-exported activities.
**Steps:**
1. Build inner Intent targeting `com.Slack.ui.WebViewActivity` with extras `extra_url` and `extra_title`.
2. Wrap it as Parcelable extra `extra_deep_link_intent` in an Intent targeting exported `com.Slack.ui.HomeActivity`.
3. Call `startActivity(start)`; HomeActivity.onResume passes the nested intent to startActivity, opening the WebView.
4. Use `javascript:` scheme for XSS or spoofed title for phishing; similarly target `com.Slack.ui.CallActivity` with action `create` and call extras to trigger fake calls.
**How found:** Code review of exported HomeActivity found onResume calling handleIntentExtras(getIntent()) which startActivity()s an attacker-controlled Parcelable Intent extra.
**Exploitation:** Any unprivileged installed app sends an Intent to exported HomeActivity carrying a nested Intent; Slack launches the protected activity, enabling arbitrary URL loading in WebView, fake calls to real users, spoofed files/comments for social engineering.
**Escalation:** Chaining intent redirection to multiple protected activities (WebViewActivity, CallActivity) to spoof UI, trigger XSS via javascript: scheme, and phish users.
**Insight:** On Android, grep exported activities for getParcelableExtra of Intent types passed to startActivity; nested-intent redirection bypasses non-exported protections and enables WebView javascript: XSS and UI spoofing.