Intent redirection vulnerability in third-party SDK exposed ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.microsoft.com/en-us/security/blog/2026/04/09/intent-redirection-vulnerability-third-party-sdk-android/
• Blog Title: Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting -> Intent Injection (and/or add a subsection/page for Intent Redirection / Exported Components + Intent.parseUri URI_ALLOW_UNSAFE abuse, including content provider URI permission/persistable grant implications)

🎯 Content Summary

Title/Context
Microsoft Defender Security Research identified a severe Android intent redirection vulnerability in a widely used third‑party Android SDK: EngageSDK (EngageLab). The issue enables a malicious app installed on the same device to coerce a vulnerable host app into launching attacker-controlled intents under the host app’s identity/permissions, potentially enabling access to private app data (PII, credentials, financial data), including vi...

🔧 Technical Details

1. Exported component + untrusted “intent forwarding” = intent redirection
   If an Android app (or embedded SDK) exposes an exported Activity/Receiver/Service that accepts attacker-controlled extras/data and then forwards/dispatches a new Intent derived from that input, the attacker can “borrow” the victim app’s identity and permissions. The risk becomes severe when the forwarded intent is (a) explicit (targets a specific component/package) or (b) insufficiently validated, allowing cross-app privilege abuse and access to protected components.
   
   2) Unsafe parsing of intent URIs + URI permission grants can create persistent provider access
   Using Intent.parseUri(..., URI_ALLOW_UNSAFE) (URI_ALLOW_UNSAFE = 4) on attacker-controlled strings can allow inclusion of URI permission grant flags in the parsed intent. If the victim app then launches the intent (e.g., startActivity()) and the target URI is a ...

🤖 Agent Actions

I’m mapping the Android/mobile sections first, then I’ll read the existing intent/component documentation before deciding whether this needs a new subsection or a different file.
I found the obvious candidate files. Next I’m reading the existing Android IPC and intent pages plus nearby docs to avoid duplicating material and to match HackTricks style.
The current intent page already covers generic Intent.parseUri(...) reparse bugs, but not the specific high-value pattern from this blog: exported proxy activity plus URI_ALLOW_UNSAFE granting persistent content-provider access. I’m checking adjacent files and repo-wide mentions now.
I’ve narrowed the update to a single file: intent-injection.md. Before editing, I’m checking the rest of that page for any existing section on URI_ALLOW_UNSAFE, provider grant flags, or merged-manifest supply-chain patterns.
I have enough context. I’m editing the existing intent page now, adding a focused subsection for exported SDK proxy components, Intent.parseUri(..., URI_ALLOW_UNSAFE), and content-provider grant persistence, then I’ll verify the diff and resulting markdown.
Updated intent-injection.md.

The addition is focused and non-duplicative: it documents the specific technique from the Microsoft post that HackTricks was missing, namely exported SDK-added proxy components in the merged manifest that parse attacker-controlled intent: strings with Intent.parseUri(..., URI_ALLOW_UNSAFE) and preserve URI grant flags, enabling confused-deputy access to content:// providers and potentially persistent provider access.

I kept it in a single existing file, added concise hunting notes, ADB testing ideas, merged-manifest review guidance, and appended the Microsoft blog plus official Android references in the existing ## References section. Verified with git diff and a re-read of the modified section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.microsoft.com/en-us/security/blog/2026/04/09/intent-redirection-vulnerability-third-party-sdk-android/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting -> Intent Injection (and/or add a subsection/page for Intent Redirection / Exported Components + Intent.parseUri URI_ALLOW_UNSAFE abuse, including content provider URI permission/persistable grant implications)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0