IssueTracker

Project: platform/frameworks/support
Branch: androidx-main
Author: Radha Nakade <radhanakade@google.com>
Link:      https://android-review.googlesource.com/3510337

Migrate traffic from pixel2 to mediumphone on FTL emulators.

Migrate traffic from pixel2 to mediumphone on FTL emulators. 
 
Bug: 396715333 
 
Test: ./gradlew emoji2:emoji2-emojipicker:ftlmediumphoneapi33 
Change-Id: If5555443ca1a91479128e1bd6f4f909154c40ba2

Thank you for your response.

🔴The severity of this issue depends on the context:

1. High Severity (Security Risk) – If JavaScript is executing without user interaction on a potentially malicious site, it could indicate XSS (Cross-Site Scripting), or browser exploitation. This could lead to unauthorized data access or malware execution.

2. Medium Severity (Privacy Concern) – If a site is executing JavaScript without explicit user permission, it might be tracking behavior, logging keystrokes, or displaying intrusive popups.

🔴JavaScript is already executing without any user interaction.

🔴 I can perform both pop-ups and redirects, as well as force file downloads through (JavaScript execution—without requiring user interaction.) This type of execution is commonly exploited in various attacks, including malware threats such as Adware, Spyware, and more. Given the security implications, I believe an S4 severity rating may not fully reflect the risk.

Would it be possible to reconsider the severity level?

Best Regards

Thanks for reaching out! This is actually a security issue, not a feature request.

Thank you for your response.

🔴The severity of this issue depends on the context:

1. High Severity (Security Risk) – If JavaScript is executing without user interaction on a potentially malicious site, it could indicate XSS (Cross-Site Scripting), or browser exploitation. This could lead to unauthorized data access or malware execution.

2. Medium Severity (Privacy Concern) – If a site is executing JavaScript without explicit user permission, it might be tracking behavior, logging keystrokes, or displaying intrusive popups.

🔴JavaScript is already executing without any user interaction.

🔴 I can perform both pop-ups and redirects, as well as force file downloads through (JavaScript execution—without requiring user interaction.) This type of execution is commonly exploited in various attacks, including malware threats such as Adware, Spyware, and more. Given the security implications, I believe an S4 severity rating may not fully reflect the risk.

Would it be possible to reconsider the severity level?

Best Regards

Thank you for providing more feedback. Adding the requester to the CC list.

Would it be possible to revisit the severity level? Please refer to comment 3.

Would it be possible to revisit the severity level? Please refer to comment 3 + comment 9

PoC for Hidden Form-Based Cookie Exfiltration

Title: Hidden Form Auto-Submission PoC for Cookie Exfiltration

Description:
A critical vulnerability has been identified where an attacker can exploit an attacker can exploit a hidden form with auto-submission to exfiltrate user cookies, browser details, and referrer data. This Proof of Concept (PoC) demonstrates how an attacker can silently extract this information upon page load, requiring no user interaction.

PoC Code: CookieHunt2025.html (Attached)

Steps to Reproduce - Hosting the PoC HTML File:

1.Remote Host

• 1: Host on a Remote Web Server
  • Upload CookieHunt2025.html to a public web server (e.g., Apache, Nginx, Netlify, or GitHub Pages).
  • Ensure the page is accessible via a public URL, e.g., https://attacker.com/CookieHunt2025.html.

2. Open the Hosted Page

• Visit the hosted PoC URL in any browser.
• The page automatically collects the following data:
  • document.cookie (Session cookies)
  • navigator.userAgent (Browser and OS details)
  • document.referrer (Previous webpage URL)

3. Observe the Data Exfiltration

• The hidden form automatically submits the stolen data to an attacker's endpoint (e.g., Formspree or an attacker-controlled server).
• If using an HTTP request logger (e.g., Burp Suite, RequestBin), observe the exfiltrated data in real-time.

Mitigation Recommendations:

• Enforce Content Security Policy (CSP) to block unauthorized form submissions.
• Set HttpOnly and Secure attributes for cookies to prevent JavaScript access.
• Implement SameSite cookie restrictions to prevent cross-site attacks.
• Use Subresource Integrity (SRI) to prevent injection of malicious scripts.

Impact:

This vulnerability poses a severe security risk by enabling attackers to exfiltrate user cookies, referrer URLs, and browser details without the victim's knowledge. The exploit can be embedded in:

• Phishing pages to steal authentication tokens.
• Malicious advertisements to harvest session data.
• Compromised websites to silently siphon sensitive information.

If successfully exploited, this attack could lead to session hijacking, unauthorized account access, and further exploitation of compromised user credentials.

Note: You can try hosting your own form. I replaced the form URL (https://formspree.io/f/googlevrp) in the form code to prevent any harm related to cookie stealing.

This attack could lead to session hijacking, unauthorized account access, and further exploitation of compromised user credentials.

Cookie Stealing:

🔴The severity of this issue:

• 🔴Critical: If you can steal authentication cookies (e.g., session cookies) and take over user accounts without user interaction, it is considered critical.

Best Regards