Resilience Gaps in Android IPC, SavedState and Text Layout
skip to main |<br>skip to sidebar
Lostmon Blogger
Security Research & Analisys:
Personal Blog where I expose my investigations,
advisores and some outstanding news on security.
Resilience Gaps in Android IPC, SavedState and Text Layout
Thursday, July 30, 2026
Structured Text Amplification (STA)
Architectural Model + Full Technical Evidence of Resilience Gaps in Android IPC, SavedState and Text Layout
Full titleStructured Text Amplification (STA) — An Architectural and Technical Study of Text-Driven Resource Amplification Across the Android Ecosystem<br>VersionUnified Full — July 2026 (merges STA Architectural Study v6.0 + Resilience Gaps Technical Report)<br>ResearcherManuel García Peña (Lostmon)<br>Vectors32 documented (Class A IPC/SavedState + Class B UI-thread/libminikin)<br>Companies notifiedGoogle · Meta · Microsoft · Mozilla · Opera · DuckDuckGo · Brave · Tor Project · Xiaomi · INCIBE (CNA Spain)<br>Also affectedSamsung (STA-023 series — documented)<br>Public disclosure30 July 2026 — lostmon.blogspot.com
CLASS A — IPC State Amplification: absent safe fallback in FragmentManager.restoreAllState() and system services when serialized SavedState exceeds the Binder limit. Result: persistent crash loops.
CLASS B — Interaction Surface Amplification: absent defensive limits on synchronous URL/text processing in Android’s text layout engine (libminikin.so). Result: reproducible ANR across Chromium and Gecko engines.
Architectural frame: Both classes are concrete manifestations of the same higher-level pattern — Structured Text Amplification (STA).
Table of Contents
Executive Summary
Threat Model
Testing Methodology
Research Context
Abstract
1. Structured Text Amplification — Architectural Model
2. Class A vs Class B — Concrete Mechanisms
3. Root Cause Detail
4. Affected Browsers (12 Confirmed)
5. Evidence Taxonomy
6. STA-017 — Cross-Engine ANR (Tier A Evidence)
6b. STA-027 — Edge Ask Copilot Deep Link Amplification (★NEW)
7. AOSP Commit Evidence
8. Field Evidence — Android 16
9. Complete Vector Catalog — 32 Vectors
9b. Impact Matrix
10. STA-005 — WhatsApp Variants
11. STA-015 Series — SystemUI Vectors
12. STA-019 — Firefox Four Failure Modes
13. STA-020/021 — Chrome/Edge/Brave Address Bar
14. STA-022 — DuckDuckGo
15. Cross-Platform Validation — iOS
16. Recommended Fixes (Framework + Application)
17. Vendor Notification Status
18. Disclosure Timeline
19. Glossary
20. Limitations and Future Work
21. Conclusion
References
Appendix I — External Corroboration
Appendix II — Vendor Conduct & Acknowledgements: Xiaomi
Executive Summary
This whitepaper documents Structured Text Amplification (STA) , an architectural pattern in which valid structured textual input (URLs, deep links, drafts, Intent extras) propagates through Android framework layers and progressively amplifies computational cost or state size until stability limits are exceeded.
Five key findings:
An internal fix for parts of the Class A root cause exists but is not public. Google’s LargePayloadSupport (AOSP CL 3989977) and androidx.savedstate 1.5.0 address part of the Class A root cause; the July 2026 Android Security Bulletin contained no public patches for any STA vector.
32 reproducible vectors across Class A (IPC/SavedState crash loops) and Class B (libminikin ANR), confirmed on production devices running Android 13–16.
Independent vendor validation. Xiaomi reproduced, confirmed and rewarded a persistent HyperOS vector (STA-015b). INCIBE (CNA Spain) reviewed technical reports and referred the case to MITRE (CNA Top-Level Root for the Google ecosystem) for CVE assignment.
Highest impact: STA-015-DL (CVSS 8.6). A single click on a Google Drive HTML link can escalate to a SystemUI crash loop requiring a hard reboot. Scope is Changed (browser is delivery vehicle; SystemUI is the target).
Cross-engine, cross-vendor. The same libminikin blocking path appears in Chromium and Gecko; the same persistence pattern appears in WhatsApp, Threads, Firefox, Opera, DuckDuckGo, Edge Ask Copilot and core system services.
Primary recommendation: Framework-level hard length thresholds in libminikin and safe degradation (try/catch + discard) in FragmentManager / TaskPersister / SystemUI restore paths. Application-level URL and draft size caps are necessary but insufficient defense-in-depth.
Threat Model
Class A — IPC / SavedStateClass B — libminikin / UI thread<br>Attacker Remote (crafted link, Drive HTML, deep link) or local (paste large text)Remote (crafted URL/link) or local (long-press, focus address bar)<br>Victim Android 13–16 users of WhatsApp, Threads, browsers, SystemUI, OEM skinsAny app rendering long structured text via TextView / Compose / context menu<br>Prerequisites One click or paste; no special privilegesOne click, long-press or focus event; no special privileges<br>Goal Persistent DoS (crash loop until data clear / reboot)Transient DoS (ANR 5–16 s); can become persistent...