Mobile Deep Link & Intent Redirection
Max payout:
Guidelines
These guidelines outline our process for assessing the security impact of vulnerabilities in our mobile apps where an attacker can use a deep link, intent, URL scheme, or related cross-component primitive to bypass internal access controls and trigger sensitive actions on behalf of a victim.
Payouts are determined by the impact achieved. Findings in this category are evaluated under the corresponding impact-based payout guidelines, and we then apply any applicable deductions based on required user interaction, prerequisites and any other mitigating factors to arrive at the final awarded bounty amount.
We list the techniques below as a signal of bug classes we actively want our researcher community to look for on our mobile apps.
The triage team will apply these guidelines when assessing reports submitted to our program, however as these are only guidelines, it is within the Meta Bug Bounty team's sole discretion to assess the mitigating factors and deduction amounts on a case-by-case basis. The guidelines below may be updated at any time at the discretion of Meta Bug Bounty.
Payouts
Vulnerabilities that allow an attacker to bypass internal access controls on a victim's account via deep link, intent, URL scheme, or related mobile cross-component primitive. The reward is determined by the impact achieved, the same example payouts apply to every technique listed below.
Maximum payouts
Techniques in scope
We actively want researchers looking at the following bug classes on our mobile apps. Each can lead to any of the impact tiers above.
1. External Deep Link Redirection — A third-party app, ad, browser page, or crafted message can cause a Meta app to navigate to or invoke a private deep link or component that should only be reachable from inside the app.
2. Internal Deep Link Redirection — A component already inside a Meta app (e.g., DM, in-app browser, WebView bridge) can be made to navigate to or invoke a private deep link or component that should not be reachable from that surface.
3. Intent Redirection — An attacker manipulates the contents, action, or component of an Intent that a Meta app sends using its own identity, causing the app to launch internal components or use the victim's session to perform actions it would not otherwise.
4. URL Scheme Hijacking — An attacker-controlled application claims or intercepts a URL pattern that should be handled only by a Meta app, getting access to private or sensitive information from the victim.
5. WebView / JS Bridge Abuse via Deep Link — A deep link or intent reaches a WebView in a way that allows JavaScript injection, intent:// redirection, JS-bridge invocation, or scriptMessageReceived manipulation, using the victim's session.
Proof of Concept
The two canaries below are simple ways to verify a finding bypasses an internal access control we rely on. If you successfully reach one via any of the techniques above, you have a qualifying finding worth reporting:
• Open instagram://account_center, fb://avatar (or any other Meta deeplink that cannot be opened externally by design).
• Trigger com.bloks.www.screen_query.BloksUSFPrivacyCheckupRootScreenQuery using the victim's session, and perform a mutation with arbitrary control of app_id and parameters.
We encourage you to demonstrate the maximum achievable impact in your report, higher-impact demonstrations qualify for higher payouts under the corresponding impact guidelines. The canaries simply lower the bar for what you need to confirm before submitting.
User interaction multipliers
The example payouts above reflect 0-click scenarios. For findings that require user interaction, deductions of 50% or higher will be applied per the corresponding payout guidelines (Account Takeover, Data Access, etc.).
Mitigating factors
Out of Scope
• Reports that do not result in unauthorized actions, data exposure, or privacy violations.
• Tapjacking, StrandHogg-style overlay attacks, and similar UI-confusion attacks.
• Findings that require a rooted / jailbroken device or physical access to an unlocked device.