Arbitrary URL Loading in Home Assistant Companion for Android

This repository is a self-contained Android lab that reproduces the exploitation pattern behind CVE-2023-41898 (Home Assistant Companion for Android unvalidated deep link handling) in a reduced educational form. It is not a scanner; it contains working exploit components and a vulnerable target app. Structure: the repo has two Android applications and two web payload pages. `victim/` implements the vulnerable flow: `MyActivity.java` is an exported deep-link entry point that accepts an ACTION_VIEW intent and directly loads the supplied URI into a JavaScript-enabled WebView after only appending `mobile=1`. Its WebViewClient also recognizes the custom scheme prefix `homeassistant://navigate/` and forwards the remainder into `WebViewActivity`. `WebViewActivity.java` is the second-stage privileged WebView; if the supplied `path` starts with `http://` or `https://`, it loads that absolute URL without trust validation and exposes a JavaScript interface named `externalApp`. That bridge's `getExternalAuth()` method returns a synthetic token (`LAB_TOKEN_CVE_2023_41898_NOT_REAL`) to page JavaScript via `evaluateJavascript`. The `attacker/` app is the launcher for exploitation. `attacker/MainActivity.java` builds an explicit intent targeting `lab.cve202341898.victim.MyActivity` and sets attacker-controlled data, defaulting to `http://10.0.2.2:8000/exploit.html`. Because the intent is explicit, the victim's manifest deep-link filter for `https://my.home-assistant.io/redirect/` does not protect against this path. The `web/` directory contains the staged payload. `exploit.html` is the first-stage page loaded by the victim's initial WebView; after a short delay it redirects to `homeassistant://navigate/http://10.0.2.2:8000/second-stage.html`. This triggers the victim's internal navigation handler and opens `second-stage.html` inside the privileged WebView. `second-stage.html` then calls `window.externalApp.getExternalAuth(...)` and displays the returned token, demonstrating attacker-controlled JavaScript execution in a more privileged context. Overall exploit capability: local app-to-app trigger plus web content delivery leading to arbitrary attacker HTML/JavaScript execution in victim WebViews and abuse of an exposed JavaScript bridge to retrieve sensitive data. The lab uses only synthetic data and localhost-style emulator networking (`10.0.2.2:8000`), but the exploit chain clearly models a real-world deep-link-to-WebView pivot.