Read the bare minimum of data from the WebAPK launch intent.

chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappLauncherActivity.java

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.chrome.browser.webapps;
 
 import android.app.Activity;
 import android.content.Intent;
 import android.net.Uri;
 import android.os.Build;
@@ skipping 45 matching lines @@
         if (webappInfo == null) return;
 
         String webappUrl = webappInfo.uri().toString();
         String webApkPackageName = webappInfo.webApkPackageName();
         int webappSource = webappInfo.source();
         String webappMac = IntentUtils.safeGetStringExtra(intent, ShortcutHelper.EXTRA_MAC);
 
         ChromeWebApkHost.init();
         boolean isValidWebApk = isValidWebApk(webApkPackageName, webappUrl);
 
+        if (isValidWebApk) {
+            // {@link #isValidWebApk} checks whether the start URL sent in the intent is in the
+            // scope of a WebAPK but it does not check that the intent was sent from Chrome. Unlike
+            // non-WebAPK web apps, WebAPK ids are predictable. A malicious actor may send an intent
+            // with a valid start URL and arbitrary other data. Only use the start URL, the package
+            // name and the ShortcutSource from the launch intent and extract the remaining data
+            // from the <meta-data> in the WebAPK's Android manifest.
+            webappInfo = WebApkMetaDataUtils.extractWebappInfoFromWebApk(
+                    webApkPackageName, webappUrl, webappInfo.source());
+
+            if (webappInfo == null) return;
+        }
+
         // Permit the launch to a standalone web app frame if any of the following are true:
         // - the request was for a WebAPK that is valid;
         // - the MAC is present and valid for the homescreen shortcut to be opened;
         // - the intent was sent by Chrome.
         if (isValidWebApk || isValidMacForUrl(webappUrl, webappMac)
                 || wasIntentFromChrome(intent)) {
             LaunchMetrics.recordHomeScreenLaunchIntoStandaloneActivity(webappUrl, webappSource);
             Intent launchIntent = createWebappLaunchIntent(webappInfo, webappSource, isValidWebApk);
             startActivity(launchIntent);
             return;
@@ skipping 114 matching lines @@
         if (webApkPackage == null || !ChromeWebApkHost.isEnabled()) {
             return false;
         }
         if (!webApkPackage.equals(WebApkValidator.queryWebApkPackage(this, url))) {
             Log.d(TAG, "%s is not within scope of %s WebAPK", url, webApkPackage);
             return false;
         }
         return true;
     }
 }