Pinterest Lite can be opened via LauncherActivity to load arbitrary urls and execute javascript in a webview

Disclosed by
Abhishek00
  • Engagement Undisclosed
  • Disclosed date over 5 years ago
  • Reward $600
  • Priority P4 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by customer

Pinterest Lite on Android before version 1.0.3 can be launched with malicious input. It could be exploited to load arbitrary links and execute Javascript code.

Summary by Abhishek00

Can we disclose without comments

Activity