# [Grab Android/iOS] Insecure deeplink leads to sensitive information disclosure

Grab app's HELPCENTER deeplink loaded arbitrary attacker URLs in a WebView exposing JS bridges that leaked the user's Grab profile on Android and iOS.

- Payout: hidden
- Severity: high
- Program: Grab
- Found by: bagipro
- Disclosed: 2019-03-15
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/401793
- Library page: https://bugbountylibrary.com/r/h1%3A401793
- Tags: area:mobile domain:mobile impact:pii-leak kind:bounty platform:hackerone sev:high technique:js-analysis technique:source-review vuln:access-control vuln:info-disclosure vuln:xss

**Target:** Android/iOS passenger app deeplink handler and in-app WebView
**Root cause:** The grab://open?screenType=HELPCENTER deeplink passed an unvalidated page parameter into a WebView, and the WebView exposed a JavascriptInterface (Android.getGrabUser / window.grabUser) with no origin checks, so any loaded page could read the user object.
**Steps:**
1. Enumerate deeplinks; find `grab://open?screenType=HELPCENTER&page=<url>` loads the page param in `com.grab.pax.support.ZendeskSupportActivity` WebView.
2. Host attacker HTML at `https://s3.amazonaws.com/edited/page2.html` that calls `window.Android.getGrabUser()` (Android) or `JSON.stringify(window.grabUser)` (iOS).
3. Serve a page with `<a href="grab://open?screenType=HELPCENTER&page=https://s3.amazonaws.com/edited/page2.html">` to trigger the deeplink from an external browser/messenger.
4. Victim taps link; WebView loads attacker page which reads and exfiltrates the Grab user JSON.
**How found:** Researcher enumerated deeplinks, found HELPCENTER accepted an arbitrary page URL, then noticed the WebView registered a JavascriptInterface `Android` with `getGrabUser()`. For iOS, grepped help.grab.com JS for `getGrabUser` and found `window.grabUser` usage, confirming the same bridge exposure.
**Exploitation:** Attacker hosts a page that invokes the exposed JS bridge to dump the Grab user object, then lures the victim to click a grab:// deeplink from a browser or messenger, causing the app's WebView to load the attacker page and leak the data.
**Escalation:** Impact raised because the WebView's JS bridge exposed sensitive user data on both Android and iOS, turning an open-URL load into data disclosure.
**Insight:** When a deeplink loads attacker-controlled URLs in a WebView, check for addJavascriptInterface bridges and window.* globals; JS bridges ignore origin, so any open redirect or XSS in that WebView becomes data theft. Grep the vendor's web assets for bridge method names to discover iOS equivalents without reversing.