Researchers from Microsoft’s 365 Defender Research Team have discovered a one-click account takeover vulnerability in the popular short-form video app TikTok. The vulnerability, tracked as CVE-2022-28799, exists in the Android version of the application, which has over 1 billion downloads on the Google Play Store. Identified in February 2022, the flaw was quickly patched in the affected versions following the responsible disclosure. The vulnerability relies on the application’s implementation of WebView JavaScript interfaces, which allow apps to load and display web pages. These interfaces also create a bridge between JavaScript and Android’s native language, Java. The researchers discovered a common vulnerability with these JavaScript interfaces that allows a threat actor to inject a malicious interface that could lead to “data leakage, data corruption, or, in some cases, arbitrary code execution.” By utilizing a deeplink, a feature in the Android operating system that allows URLs to be handled by an application rather than a web browser, the researchers could exploit the JavaScript interface injection flaw. First, they utilized a redirect to access a deeplink normally only used inside the TikTok application rather than through external links. This internal deeplink uses a filter to block potentially malicious websites from being loaded through it. The researchers discovered two parameters they added to the deeplink URL which bypassed this filter. Loading a malicious website using this deeplink gave access to 70 internal Java methods, ultimately allowing a threat actor to compromise a TikTok user account. The researchers create a proof-of-concept (PoC) exploit that was successfully able to replace a victim user’s description to “!! SECURITY BREACH !!” when the user clicks on the malicious link. As stated, the vulnerability has been patched in the most recent version of the TikTok Android application and no exploitation has been discovered in the wild.