Authorized WebAuthn Bridge Validation
Controlled PlayStation Android bug-bounty PoC for a researcher-owned domain and account.
Locked
Open the owner-only launch URL. The access token remains in the URL fragment and is never sent to the server.
Checking access token…
Environment
- Page origin
- Target RP ID
my.account.sony.com- Native bridge
- Waiting for PlayStation injection…
This page performs no network requests. Assertions remain in memory and are cleared automatically.
Mode 1: redacted live bridge proof
Creates a random, non-redeemable challenge and asks Android Credential Manager for a Sony passkey. A successful result proves that this unrelated origin receives a real assertion.
Mode 2: owner-only ceremony validation
Paste fresh PublicKeyCredentialRequestOptions issued during a login attempt for your own account. Nothing is submitted automatically.
The full response is available only after an owner-confirmed ceremony and is kept for 90 seconds.
Redacted evidence
No request has run.
{}