Instagram for android does not handle some CYRILLIC letters like U+043E: CYRILLIC SMALL LETTER O so if we create hostname using Cyrillic small letter о like the it could crash instagram: http://gо...

XSS vulnerability found in Koo App: Koo is a Bengaluru-based microblogging mobile application with 5 million users which is known to be an Indian alternative to Twitter. Koo app allows users to con...

Description: Facebook Messenger for Android reuses the Thread ID when invoked via deeplink which could have led attacker to produce indirect thread deletion vulnerability. This can lead to some c...

Google Photos android app’s activity com.google.android.apps.photos.pager.HostPhotoPagerActivity has set to exported with intent filter has file scheme support which means third party app could use...

Using fb://webview deep link it is possible to bypass linkshim protection and user redirected to evilzon site without notice. Timeline: 12 September 2018: Reported 13 September 2018: Triag...

There is an inconsistency in the way Facebook iOS Inbox which uses WebView component renders some web page redirections in a way that allows an attacker to perform address bar spoofing, resulting i...

Page Admin Disclosure when clicking join button in Page inbox of mobile version Description: Every facebook group has feature “Share this group” with option like how to share (share on your time...

Description: Attack can perform substring search for emails even if Workplace admin hides email profile field. As admin From the Admin Panel, goto Settings >> Profile fields >> on Ema...

Summary: Mitron app which recently brought attention because of in less time 5 Million downloads and competitors to TikTok, But this app is designed with no security at all, lets come to the proof ...

Yet another android vulnerability which I found on Xiaomi: giant mobile manufacturer company. Summary: There inbuilt SMS is an application pre-installed on those devices. The application is built ...