I'm testing Android app which is vulnerable to HTML injection, but I'm having problem escalating it to a stored XSS vulnerability.
I have tried these, and many more:
None of these work - they don't render or links/tags are not clickable.
I have also tried using Android event handlers like
ontouchstart and so on, but none of them seem to work either.
However I have noticed that I can load any image like this:
I tried adding event handlers there too, but it did not work.
I'm out of ideas. I have tried googling for this but I can't seem to find answer why it does not work. I was thinking can it be because I'm running on Android 5.1.1, which does have some built-in XSS protection?