[PayPal Android] Remote theft of user session using push_notification_webview deeplink

Summary

A deeplink feature built into the PayPal Android application failed to validate the requested endpoint. A specifically crafted request from a website or separate app on the device could call the deeplink and direct traffic to any destination. While the impact was limited by compensating controls, headers containing sensitive data could be collected by a malicious actor.

This vulnerability was discovered in collaboration with security researcher khilly, who contributed significantly to identifying and testing the deeplink misuse in the PayPal Android app. Together, we demonstrated how the lack of validation in the deeplink mechanism could allow a malicious app or webpage to redirect user sessions and expose headers containing sensitive information. The issue was responsibly disclosed and later resolved by PayPal.