Android XSS — exported Activity via ContentActivity (POE/Quora real report)

Quick answer

On Android, an Activity marked exported="true" can be invoked by any installed app via an Intent — with no permissions. If that Activity accepts an html parameter and loads it directly into a WebView with the main domain's context (www.quora.com), you have stored XSS on mobile + access to the native JSBridge + escalation to RCE on Android ≤4.2. Quora paid $2,500 for this in 2016 and the pattern is still valid in modern Android apps (banking, social, productivity). 5 minutes with adb + Drozer reveal whether your target is vulnerable.

1. Refresher: how Android Intents work

Android has 4 component types: Activities, Services, BroadcastReceivers, ContentProviders. Any of them can have android:exported="true" in the AndroidManifest.xml.

<activity
    android:name=".ContentActivity"
    android:exported="true">    <!-- ❌ accesible desde cualquier app -->
</activity>

When exported=true:

• Any installed app can invoke it with an Intent.
• It requires no special permissions (unless declared with <permission>).
• The Intent extras are 100% attacker-controlled.

Why exported=true is sometimes set

• Deep links (https://target.com/x → opens Activity X).
• Integrations with other apps (share intent, file picker).
• Custom URL schemes (myapp://).
• On Android 12+ it's mandatory to explicitly declare exported=true/false — many devs set it true "for security" without understanding it's the opposite.

2. The real case — Quora Android (2016, $2,500)

Affected activities

<activity android:name="com.quora.android.ContentActivity" android:exported="true"/>
<activity android:name="com.quora.android.ModalContentActivity" android:exported="true"/>
<activity android:name="com.quora.android.ActionBarContentActivity" android:exported="true"/>

All three accepted two Intent extras:

The WebView was loaded with the context of www.quora.com — that is, any injected JS ran with that origin and with access to the native QuoraAndroid JSBridge.

Base payload via ADB

adb shell am start \
  -n com.quora.android/com.quora.android.ActionBarContentActivity \
  -e url 'http://test/test' \
  -e html 'XSS<script>alert(document.domain)</script>'

Result: an alert with www.quora.com → XSS in Quora's authenticated context.