v8 bug tracked in 664411
play store bug for "inject javascript to play.google.com to install any app;" tracked in 554518 and http://b/25640668

should we file bug for ""use intent scheme to launch the installed app." ?

For intent scheme, do we know how they do "inline hook processingUserGesture and utilizeUserGesture to bypass guesture detection"?

Andrew is working to get access to exploit, right now, just writeup.txt in c#0.

See also http://b/25754017 for always prompting the user when installing an app from the web flow.

Here is exploit.

Deleted: exploit.zip 163 KB

exploit.zip 163 KB Download

Pri-0 bugs are critical regressions or serious emergencies, and this bug has not been updated in three days. Could you please provide an update, or adjust the priority to a more appropriate level if applicable?

If a fix is in active development, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Your change meets the bar and is auto-approved for M56 (branch: 2924)

Metabug, nothing to merge.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot