[lucb1e]

Only if the other services provide a network proxy right? You'd need to find an exploit in the app otherwise.

Edit: although, I just remembered that it's actually as simple as sending "open this URL" intents to the Android equivalent of sensible-browser, which everyone will have installed. That does rely on users not understanding or caring about what's happening or it only works for the first user

[gf000]

Yeah, there are endless holes unfortunately with IPC. It has been hardened by more recent android versions https://developer.android.com/guide/topics/manifest/queries-...

but even something like "share via Chat app" can be used to leak information, e.g. it will have the link preview loaded".