Executive brief
A security flaw in the Moovit public transit app for Android allows malicious actors to manipulate how the app handles web links. By exploiting an improperly secured internal component, an attacker can force the app to display fraudulent websites or phishing pages within the trusted Moovit interface. This could lead to users unknowingly providing sensitive information, such as login credentials or personal data, to a malicious party.
Technical details
The Moovit Android application (v1.18) contains an exported and browsable activity, 'com.moovit.web.WebViewActivity', which fails to properly validate or restrict externally supplied URLs. This component (part of the com.tranzmate package) handles custom URL schemes and intents without sufficient domain allowlisting. A local attacker or a malicious app on the same device can trigger this activity via crafted intents to load arbitrary web content within the application's internal WebView. This can be leveraged for UI spoofing, phishing, and credential theft by rendering attacker-controlled pages inside the trusted app context. As of the disclosure, the vendor has not responded to the report.
Affected products
- Moovit Moovit Bus & Public Transit App 1.18
Timeline
- 2026-06-14: disclosed: Initial public disclosure of the vulnerability and exploit.
- 2026-06-14: advisory