V12
What happens after the tap: - A crafted link opens Ditto. - The app checks the host, but not the scheme. - The decoded path is concatenated into JavaScript. - The attacker escapes the string. - Their code runs inside Ditto’s privileged WebView.
V12
What happens after the tap: - A crafted link opens Ditto. - The app checks the host, but not the scheme. - The decoded path is concatenated into JavaScript. - The attacker escapes the string. - Their code runs inside Ditto’s privileged WebView.