One Click Account Takeover via Misconfigured WebView

TL;DR: A retail Android app had a WebView exposed via deep link. JS was enabled, the url parameter accepted any scheme including…