Rating:

In this challenge, we are dealing with an Android application implementing a Webview vulnerable to XSS. This application also has a native library exposing methods vulnerable to overflow (stack, heap etc.) To perform this exploit, we have to use the XSS to call the vulnerable functions of the native library. However, one of them is protected by a password that we will have to retrieve dynamically.

Original writeup (https://blog.oppida.apave.com/en/Nos-articles/Google-CTF-2021-Tridroid).