A New Era of One-Click Attacks: How to Break Install-Less Apps
summary
Finds multiple practical exploits across Install‑Less platforms and demonstrates working attacks: one‑click remote RCE on QuickApp by abusing the downloadFile API and writing a malicious native library into the engine’s private cache then forcing it to load; MITM RPK replacement to deliver the payload via deep link/NFC; address‑bar spoof via blob+title to make a PWA show a trusted domain; and turning Instant App deep‑link behavior into a remote one‑click hijack. Demos use crafted deep links, NFC/QR entry points, and served packages, and the techniques reliably execute.
AI-written summary · about
chapters (12)
- 0:00Start
- 3:16Entrance of Google Instant App
- 3:48Basic structure of Google Instant App
- 4:30Applinks in Google Instant App
- 11:01The other permission design of AppClips
- 13:15Turn local attack into remote attack by Google Instant App
- 17:50CRLF injection and Fullscreen model
- 18:54Hide the domain with blob URL
- 19:34Hijacking the address bar
- 20:50The landscape of QuickApp
- 21:28Pack files and signature methods
- 22:49Package download and signature verification
related talks
40mAll You Need Is One - A ClickOnce Love Story
35mPractical Mobile App Attacks By Example
44mWhen you can't afford 0days: Client-side exploitation for the masses
01h 02mLive Hacking: Breaking into your Web App
31m📙 From Assistant to Assassin: Weaponizing An OpenClaw Vulnerability to Achieve 1-Click RCE 🖥️
47mLive Hacking: Breaking into Your Web App
41mLive Hacking: Breaking into Your Web App
43mTrusting SDKs