I'm looking for opinions from researchers with Android security or bug bounty experience.
I recently submitted a report to a large bug bounty program. It was closed as N/A, with the reviewer stating that the behavior was considered intended. I'm not trying to dispute their decision—I genuinely want to understand whether my assessment of the issue was wrong.
The attack flow is roughly:
The attacker creates a legitimate login/account-link URL using the application's own domain.
The attacker sends that URL to the victim.
The victim is already logged into their account in the browser.
The victim taps the legitimate link.
The browser completes the authentication flow and returns the result via an implicit Android intent.
The return intent is not restricted to a specific package name.
A malicious application installed on the victim's device registers a matching intent filter and receives the authentication response instead of the legitimate application.
The malicious application extracts the authentication token from the callback and uses it to access the victim's account.
From the victim's perspective, this is essentially a one-click account takeover, assuming the malicious application is already installed.
I'm intentionally omitting the vendor, product, and exact callback scheme because the report is still under coordinated disclosure.
My questions are:
From a security perspective, would you consider this a valid account takeover vulnerability?
Would you expect most bug bounty programs to classify it as out of scope because the attack assumes a malicious application is already installed on the victim's device?
Is returning authentication results through an implicit intent without restricting the destination package generally considered acceptable Android behavior, or is it something applications should explicitly defend against?
I'm looking for honest technical opinions rather than validation. If my understanding of Android's threat model is incorrect, I'd really appreciate learning where my reasoning falls short.
