Month: October 2026

I gave a separate Android app an intent that Glassdoor should have treated as external. It opened Glassdoor’s internal Apply screen, loaded JavaScript I controlled, and ended on Glassdoor’s real “Your application was sent” screen. I had not…

I found a route bypass in Linktree’s Android app. A crafted deep link could open an arbitrary website inside Linktree, give the page a trusted-looking title, and hide the separate domain label. I reproduced the behavior on version…