Mobile Platform Interaction

What Is Broken and Why

Mobile platforms expose rich IPC mechanisms (Intents, Content Providers, URL schemes, XPC, Pasteboard) that apps use to communicate. Without proper access control, exported components become attack vectors: a malicious app can send crafted Intents to trigger sensitive operations, read Content Provider data without permission, or hijack deep links by registering the same scheme. WebViews with JavaScript enabled and addJavascriptInterface create XSS-to-RCE bridges. Deep link URL parameters injected into WebView navigation or SQL queries without sanitization enable injection attacks within the app.

Key Signals

• android:exported="true" on Activity, Service, or BroadcastReceiver without android:permission
• ContentProvider with android:exported="true" and no read/write permission constraints
• setJavaScriptEnabled(true) in a WebView that loads remote/user-supplied URLs
• addJavascriptInterface(obj, "name") exposing Java objects to WebView JS
• onReceivedSslError().proceed() (also a network issue, creates XSS delivery path)
• Deep link Intent filter <data android:scheme="app"> without caller validation
• iOS: custom URL scheme registered without origin verification
• PendingIntent created with implicit Intent and no FLAG_IMMUTABLE
• iOS: UIPasteboard.generalPasteboard writes containing credentials
• WebView setAllowFileAccess(true) or setAllowFileAccessFromFileURLs(true)
• filterTouchesWhenObscured absent on security-sensitive touch targets