In reply to @v12sec

V12

@v12sec · Twitter · 2026-09-02 19:22 UTC

Android’s `Uri.getPath()` percent-decodes the path before it reaches the vulnerable code. So `%5C%27` becomes `\'`, turning the final statement into: `window.location.href = '/\\'; ATTACKER_JAVASCRIPT //';` The quote ends the string, the payload executes, and `//` swallows the rest.