# Exported WebView loads attacker content

Exported activity or SDK component feeding intent extras into a JavaScript-enabled WebView

_Area: Mobile app security. Seen in 3 disclosed reports; 2 confirmed bounties: $400 and $1,075; latest 2022-05-24. Updated 2026-10-23._

## How it works
An activity that other apps can start (exported) takes a URL or HTML string from the calling intent and hands it to a WebView with JavaScript enabled. The app assumes only its own code will launch the component, but Android lets any installed app start an exported activity and supply the extras. The WebView then renders attacker content as if it were the app's own, in the app's WebView context and cookie jar.

## Where it shows up
- `android:exported="true"` activities, especially third-party SDK activities merged into the manifest (SurveyMonkey `SMFeedbackActivity`) [E1](https://bugbountylibrary.com/r/h1%3A1455987.md)[E3](https://bugbountylibrary.com/r/h1%3A532836.md)
- Intent extras named like `smSPageHTML`, `smSPageURL`, `CHECKOUTURL` traced into `loadDataWithBaseURL()` or `loadUrl()` [E1](https://bugbountylibrary.com/r/h1%3A1455987.md)[E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-mobile-facebook-android-webview-vulnerability.md)[E3](https://bugbountylibrary.com/r/h1%3A532836.md)
- WebView settings with JavaScript enabled and no origin restriction
- URL validation that only checks `http`/`https` and lets `javascript:` through [E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-mobile-facebook-android-webview-vulnerability.md)
- `loadDataWithBaseURL` with a baseURL that sets the origin for injected HTML [E1](https://bugbountylibrary.com/r/h1%3A1455987.md)

## How to review
Enumerate exported components in the merged manifest, including SDK activities. For each, trace every intent extra to a sink (`loadUrl`, `loadDataWithBaseURL`, `loadData`). The invariant: an exported component must not pass caller-controlled data into a JavaScript-enabled WebView, or must strictly allowlist schemes and origins and reject `javascript:` and `data:`. Confirm the WebView cannot read the app's cookies or storage for the loaded content.

## Variants seen
- SDK activity exported by default, HTML extra into `loadDataWithBaseURL` with JS on [E1](https://bugbountylibrary.com/r/h1%3A1455987.md)[E3](https://bugbountylibrary.com/r/h1%3A532836.md)
- App's own exported activity, URL extra into `loadUrl` with weak scheme check [E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-mobile-facebook-android-webview-vulnerability.md)
- Same SDK component reused across multiple apps [E1](https://bugbountylibrary.com/r/h1%3A1455987.md)[E3](https://bugbountylibrary.com/r/h1%3A532836.md)

## Impact and severity
Universal XSS in the app's WebView context led to cookie theft and account takeover [E1](https://bugbountylibrary.com/r/h1%3A1455987.md)[E3](https://bugbountylibrary.com/r/h1%3A532836.md); arbitrary site loading and JS execution [E2](https://bugbountylibrary.com/r/blog%3Aservicenger-com-mobile-facebook-android-webview-vulnerability.md). Severity is high because the WebView shares the app's session; cookie file access widened impact [E3](https://bugbountylibrary.com/r/h1%3A532836.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1455987.md
- E2: https://bugbountylibrary.com/r/blog%3Aservicenger-com-mobile-facebook-android-webview-vulnerability.md
- E3: https://bugbountylibrary.com/r/h1%3A532836.md