Account Takeover through XSS on websites is nothing new. But does the same attack vector exist on Android?
This was one of the most complex findings we came across in 2025.
https://t.co/x3sGhc8Fg4
HTML Injection That Paid $3K
Main issue: most websites only rely on SameSite cookies for CSRF protection.
No XSS? No problem.
HTML Injection + <form> can still trigger sensitive actions.
Hope this helps!
Honorable mention to my bug bounty partner @fariqfgi π
Once, a friend told me, "If you know how to hack but still struggle with dupes or informatives, stop asking for technical advice, start asking for psychological advice instead."
Now, my ChatGPT is basically my personal psychiatrist π
π―
When I was a teenager about 6 years ago, it hit me hard... made me quit hunting, and now, in the middle of this year, I'm starting again from zero.
Just enjoy your hundred rejections/duplicates/informative. But don't stop.
Bug Bounty Tip:
Don't compare your day-to-day with someone else's wins.
Behind every $10K bug post are dozens of duplicates, N/As, and dead ends.
Stay consistent; that's what really counts.