Today my wife did a websearch in vanadium on grapheneos on a pixel 7a
The websearch-result from duckduckgo.com she clicked was this

I don't want to write down the url in case of, it's a hacked and infected website.

It is a legitim result. It's ok for the thematic, she searched, and the location is ok. It looks like a report from a visit in the "Garten Tulln"... which is a well known exhibition in tulln.
So she clicked on the link in vanadium.

I heard her from the other room, "Oh no, what happens here now? Please help me!"
And she came to me, showing me the phone. She had closed the website and told me "something weird happened. So i closed this site". And then she received a sms with a buying-confirmation

and 2 minutes later an email with the same confirmation from the mobile-provider

I could verify the puchase in the customer-zone from the mobile-provider:

At this moment, i hat no time to investigate further, so i told her, to turn off the phone, so that a possible malware can not infect other computers in our network.

I called a friend to talk about this. He also has grapheneOS and knows, what I'm talking about.

He tried to open the page and got a 520 error from Cloudflare. A bit later he tried it again and reached the site. But it got redirected, and ublock blocks this redirection:

He told me, he fiddled around with this site on his computer, and the redirection finally wants to install something on his computer. Malware...
My first thought was, did i accidentially allow sideloading unknown apps for vanadium, when i installed her phone?

No:

So my fazit is:
She visited a site, which got hacked.
You can see a search https://duckduckgo.com/?q=site%3Aulrike-trebesius.de&t=fpas&ia=web which shows "normal" content indexed. And now it is most time blocked by cloudflare and sometimes the url redirects to a weird url, as shown above in the screenshot, which tries to install something via your browser.

Vanadium did not block this software, and it must be a very coicidence that opening this prepared website and becoming victim of some other fraud based on data from a data-breach. Because it was at the same time. Within less than a minute after opening this website.

Something downloaded and run by the browser could gather information about the phone-number and do a 3rd-party purchase from the browser.

That is the information, i could gather from this incident.
I tried to get the logfile, after i turned on the phone again, when i had time to investigate.
But the systemlog got deleted. It starts with the power on from me.
I did not know, that grapheneos deletes logfiles from the last boot before. If you think you need it. I can upload it somewhere.

I think, there is a vulnerability in vanadium or grapheneos and the infected website is able to exploit this vulnerabilty.

I need to know, what i have to do now. How can i find out, if there is really malware installed?
Is it enough to reset the browser?
Or should i reinstall grapheneOS from scratch?
Personally i tend to the second...
And how can we catch a possible vulnerability? I'm willing to help, to find out, what's going on. But i need support from people, who are more comfortable with android. I'm "only" a linux sysadmin.

Thank you
Jakob