CVE-2026-28613

A vulnerability exists in ChannelImpl.java within the initAppLinkTypeAndIntent method due to improper input validation . This flaw allows for the launch of an arbitrary intent , which could lead to a local escalation of privilege without requiring additional execution privileges. Exploitation of ...

MobSF has SSRF port restriction bypass in assetlinks_check

SummaryMobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the coder open app process. An attacker can obtain a user's session token and impersonate their account by crafting a malicious external app URL containing a session token placeholder, which is then replaced with the...

PT-2026-45593

In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-6431

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. This bug only affects...

CVE-2020-1697

It was found in all keycloak versions before 9.0.0 that links to external applications Application Links in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further...

chromium-browser: URI bar spoof when using external app URIs

Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...