# [IRCCloud Android] XSS in ImageViewerActivity

Exported ImageViewerActivity in IRCCloud Android passes attacker-controlled URL into loadDataWithBaseURL HTML, allowing JS injection via crafted intent from any app.

- Payout: hidden
- Severity: medium
- Program: IRCCloud
- Found by: bagipro
- Disclosed: 2017-11-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/283063
- Library page: https://bugbountylibrary.com/r/h1%3A283063
- Tags: area:mobile domain:mobile impact:integrity kind:bounty platform:hackerone sev:medium tech:android technique:source-review vuln:xss

**Target:** Android exported activity (com.irccloud.android.activity.ImageViewerActivity)
**Root cause:** Exported activity accepts attacker-controlled data URI, passes it through ImageList.fetchImageInfo unchanged, then concatenates it into an HTML string loaded via WebView.loadDataWithBaseURL without sanitization.
**Steps:**
1. Identify exported ImageViewerActivity with VIEW/BROWSABLE intent filters on IMAGE_SCHEME.
2. Craft intent with setClassName to com.irccloud.android.activity.ImageViewerActivity and data URI containing `https://shoppersocial.me/wp-content/uploads/2016/06/wow.jpg' onload='window.location.href="http://yahoo.com"`.
3. startActivity(intent) from any installed app (or Instant App from browser).
4. Activity replaces scheme with http, fetchImageInfo returns URL as thumbnail, loadImage concatenates into HTML img src, breaking out of attribute and executing JS.
**How found:** Code review of exported activity's intent handling and tracing the data flow from getIntent().getDataString() through ImageList.fetchImageInfo into loadImage's HTML string concatenation.
**Exploitation:** Any app on device (or Android Instant App from browser) launches the exported activity with a crafted URI; the URL is embedded into a WebView HTML img tag, breaking out of the src attribute to run arbitrary JS in the WebView context.
**Insight:** Exported Android activities that feed intent data into WebView.loadDataWithBaseURL are prime XSS targets; trace getDataString() into any HTML string concatenation, and check for BROWSABLE filters enabling Instant App/browser triggers.