Thankfully the problem was fixed back in March, less than a month after private disclosure. Account modification, private video access, and video upload are all accessible.

If this is untrusted code, it gives away the figurative keys to the kingdom, as an auth token can be accessed for the current user. The JavaScript that runs in the app browser exposes 70+ methods to JS running on the page. Once an arbitrary page is loaded, the biggest problem shows up. One of these internal schemes has the effect of loading an arbitrary page in the app webview, and while there is a filter that should prevent loading untrusted hosts, it can be bypassed with a pair of arguments included in the URI call. The problem here is that this does trigger a redirect, and app-internal deeplinks aren’t filtered out. The vulnerability chain starts with a link handler published to Android, where any com/redirect links automatically open in the TikTok app. This week Microsoft reveals the other side of that security coin - JavaScript on a visited website may be able to interact with the JS embedded in the app browser. A couple weeks ago we talked about in-app browsers, and the potential privacy issues when opening content in them.

Kali linux anonymous hacking tor vs vpn