[Venmo Android] Remote theft of user session

Summary

A URL activity in the Venmo application used the built-in android.net.Uri parser, which has a known logic problem with certain characters. If an external URL were passed from a website or other app on the device to the application activity, the app would open the URL without properly validating the destination. This could expose some session data to a third party.

This issue was initially identified during a joint security review conducted by me and khilly. Khilly highlighted a logic flaw in the Venmo app’s use of android.net.Uri parser, which we further explored together. We confirmed that unvalidated external URLs could be used to trigger in-app redirection and expose session data. Our coordinated effort led to this report, which was acknowledged, rewarded, and resolved by PayPal.