| Full title | Structured Text Amplification (STA) — An Architectural and Technical Study of Text-Driven Resource Amplification Across the Android Ecosystem |
| Version | Unified Full — July 2026 (merges STA Architectural Study v6.0 + Resilience Gaps Technical Report) |
| Researcher | Manuel García Peña (Lostmon) |
| Vectors | 32 documented (Class A IPC/SavedState + Class B UI-thread/libminikin) |
| Companies notified | Google · Meta · Microsoft · Mozilla · Opera · DuckDuckGo · Brave · Tor Project · Xiaomi · INCIBE (CNA Spain) |
| Also affected | Samsung (STA-023 series — documented) |
| Public disclosure | 30 July 2026 — lostmon.blogspot.com |
CLASS A — IPC State Amplification: absent safe fallback in FragmentManager.restoreAllState() and system services when serialized SavedState exceeds the Binder limit. Result: persistent crash loops.
CLASS B — Interaction Surface Amplification: absent defensive limits on synchronous URL/text processing in Android’s text layout engine (libminikin.so). Result: reproducible ANR across Chromium and Gecko engines.
Architectural frame: Both classes are concrete manifestations of the same higher-level pattern — Structured Text Amplification (STA).
Table of Contents
- Executive Summary
- Threat Model
- Testing Methodology
- Research Context
- Abstract
- 1. Structured Text Amplification — Architectural Model
- 2. Class A vs Class B — Concrete Mechanisms
- 3. Root Cause Detail
- 4. Affected Browsers (12 Confirmed)
- 5. Evidence Taxonomy
- 6. STA-017 — Cross-Engine ANR (Tier A Evidence)
- 6b. STA-027 — Edge Ask Copilot Deep Link Amplification (★NEW)
- 7. AOSP Commit Evidence
- 8. Field Evidence — Android 16
- 9. Complete Vector Catalog — 32 Vectors
- 9b. Impact Matrix
- 10. STA-005 — WhatsApp Variants
- 11. STA-015 Series — SystemUI Vectors
- 12. STA-019 — Firefox Four Failure Modes
- 13. STA-020/021 — Chrome/Edge/Brave Address Bar
- 14. STA-022 — DuckDuckGo
- 15. Cross-Platform Validation — iOS
- 16. Recommended Fixes (Framework + Application)
- 17. Vendor Notification Status
- 18. Disclosure Timeline
- 19. Glossary
- 20. Limitations and Future Work
- 21. Conclusion
- References
- Appendix I — External Corroboration
- Appendix II — Vendor Conduct & Acknowledgements: Xiaomi
Executive Summary
This whitepaper documents Structured Text Amplification (STA), an architectural pattern in which valid structured textual input (URLs, deep links, drafts, Intent extras) propagates through Android framework layers and progressively amplifies computational cost or state size until stability limits are exceeded.
Five key findings:
- An internal fix for parts of the Class A root cause exists but is not public. Google’s LargePayloadSupport (AOSP CL 3989977) and androidx.savedstate 1.5.0 address part of the Class A root cause; the July 2026 Android Security Bulletin contained no public patches for any STA vector.
- 32 reproducible vectors across Class A (IPC/SavedState crash loops) and Class B (libminikin ANR), confirmed on production devices running Android 13–16.
- Independent vendor validation. Xiaomi reproduced, confirmed and rewarded a persistent HyperOS vector (STA-015b). INCIBE (CNA Spain) reviewed technical reports and referred the case to MITRE (CNA Top-Level Root for the Google ecosystem) for CVE assignment.
- Highest impact: STA-015-DL (CVSS 8.6). A single click on a Google Drive HTML link can escalate to a SystemUI crash loop requiring a hard reboot. Scope is Changed (browser is delivery vehicle; SystemUI is the target).
- Cross-engine, cross-vendor. The same libminikin blocking path appears in Chromium and Gecko; the same persistence pattern appears in WhatsApp, Threads, Firefox, Opera, DuckDuckGo, Edge Ask Copilot and core system services.
Primary recommendation: Framework-level hard length thresholds in libminikin and safe degradation (try/catch + discard) in FragmentManager / TaskPersister / SystemUI restore paths. Application-level URL and draft size caps are necessary but insufficient defense-in-depth.
Threat Model
| Class A — IPC / SavedState | Class B — libminikin / UI thread | |
|---|---|---|
| Attacker | Remote (crafted link, Drive HTML, deep link) or local (paste large text) | Remote (crafted URL/link) or local (long-press, focus address bar) |
| Victim | Android 13–16 users of WhatsApp, Threads, browsers, SystemUI, OEM skins | Any app rendering long structured text via TextView / Compose / context menu |
| Prerequisites | One click or paste; no special privileges | One click, long-press or focus event; no special privileges |
| Goal | Persistent DoS (crash loop until data clear / reboot) | Transient DoS (ANR 5–16 s); can become persistent if combined with history/TaskPersister |
| Impact scope | Single app → shared inbox → SystemUI (device UI) | Browser / app UI thread; can cascade into SystemUI on some OEMs |
Assumptions: Attacker can deliver a syntactically valid but oversized structured payload (URL, draft, Intent extra). No memory corruption or code execution is required. The attack relies solely on missing defensive limits and missing safe-degradation paths.
Testing Methodology
Research was conducted on six physical production devices running stock or OEM firmware (no custom ROMs, no root required for primary evidence). Cross-OEM validation used devices shared by the independent research community (Xiaomi, Samsung, OPPO, OnePlus, Pixel).
- Google Pixel 7 (Android 13–15 stock AOSP-derived)
- Xiaomi Redmi Note 14 5G (HyperOS 3.0 / Android 16) — primary field evidence device
- OPPO A78, OnePlus 11, Lenovo Tablet, and additional devices covering Android 9–16
A substantial portion of framework path analysis was performed by reading public AOSP sources from a phone browser (no traditional multi-monitor lab). Bugreports and ANR traces were captured on-device where available. Google VRP rewarded the Binder/IPC research area ($250); Xiaomi independently confirmed and rewarded a HyperOS vector ($300 via HackerOne).
Tools and artefacts:
Bugreport/ full bugreport ZIPs (DROPBOX SYSTEM APP CRASHES, ANR traces, tombstones)chrome://crashesreport IDs (uploaded to Google infrastructure)- Native stack unwinding from ANR traces (libminikin.so BuildId confirmed)
- AOSP source inspection for FragmentManager, TaskPersister, LineBreakOptimizer
Generalizations to “all Android OEMs” or “all versions” are inferences from this sample, not exhaustive enumeration. Behaviour can vary with OEM patches, available memory and security bulletin level. iOS was used as a negative control (same payloads do not reproduce the Android-specific failures).
Research Context
This work is independent security research conducted over approximately four years (observations from 2022; formal STA framing and expanded evidence through July 2026). It was not performed in a traditional multi-monitor laboratory environment.
Primary conditions:
- Lead researcher: Manuel García Peña (Lostmon), independent researcher; president of BojosXtu (mental-health support association).
- Primary device: Xiaomi Redmi Note 14 5G (HyperOS 3.0 / Android 16) — field bugreports, SystemUI crash statistics, and native ANR stacks were captured on this handset under normal use and controlled reproduction.
- Analysis setup: A substantial share of AOSP path reconstruction (TextView → StaticLayout → LineBreaker → libminikin; FragmentManager / TaskPersister / SystemUI) was done by reading public Android source in a phone browser, following call chains function by function when concentration allowed.
- Cross-OEM validation: Additional devices (Pixel, Samsung, OPPO, OnePlus and others) were made available through the independent research community so that behaviour could be checked beyond a single manufacturer.
- Vendor outcomes (selected): Google Android VRP rewarded the Binder/IPC research area ($250, case A-477279924). Xiaomi independently reproduced a persistent HyperOS vector and awarded a bounty via HackerOne ($300). Other vendors received reports with mixed classifications (see Section 17–18).
The technical claims in this whitepaper stand on bugreports, native stacks, measured Bundle sizes, and public AOSP inspection. The research context is included so readers understand the constraints under which the evidence was gathered — not as a substitute for that evidence.
Narrative account of the investigation (Spanish): Desafiar Android desde el sofá y un smartphone (17 July 2026). Timeline and related technical posts are listed under References.
Abstract
Android applications continuously process structured textual input originating from web pages, messaging platforms, documents, deep links, accessibility services, inter-process communication (IPC) and user-generated content.
Over approximately four years of independent analysis, 32 reproducible attack vectors were documented across multiple Android subsystems. Although these vectors differ in entry points, affected applications and observable behaviour, they consistently exhibit a common architectural characteristic: structured textual input propagates through several framework layers while progressively amplifying computational cost, memory pressure or internal application state until stability boundaries are exceeded.
This recurring behaviour is defined as Structured Text Amplification (STA).
STA is not a single vulnerability. It is an architectural resource-amplification pattern. It materialises in two primary concrete forms:
- Class A — IPC / SavedState Amplification: when serialized state exceeds the Binder transaction limit (1 048 576 bytes), Android has no safe degradation path. The TransactionTooLargeException propagates uncaught, the app (or SystemUI) crashes, and the same oversized state is re-persisted → permanent crash loop.
- Class B — Interaction Surface Amplification: algorithmic complexity inside Android’s native text layout engine (
libminikin.so) produces reproducible ANRs across Chromium and Gecko when processing oversized but syntactically valid structured URLs/text.
The most severe chain (STA-015-DL) escalates from a single click on a Google Drive HTML link to a SystemUI crash loop requiring a hard reboot (CVSS 8.6). The same underlying amplification principles appear in WhatsApp, Threads, Firefox, Opera, DuckDuckGo, Brave, Samsung Internet and core framework components.
This unified whitepaper presents both the architectural model that explains the common pattern and the complete technical evidence (native stack traces, production bugreports, AOSP commit analysis, CVSS scores and vendor responses) that substantiates it.
1. Structured Text Amplification — Architectural Model
Fact vs. interpretation: The STA model is an architectural interpretation proposed by the researcher to explain recurring patterns observed across multiple vectors. Empirical evidence (native stack traces, production bugreports, measured Bundle sizes, vendor confirmations) is presented in the corresponding technical sections. Amplification factors and the unified model itself should be treated as analytical conclusions, not as factory-documented behaviour.
1.1 Formal Definition
Unlike a traditional software vulnerability, STA does not represent a single implementation defect or memory corruption. The amplification emerges from the interaction between multiple independent components that sequentially transform, validate, serialize, deserialize, render, persist or redistribute the same logical data. Each component may operate correctly in isolation; the cumulative effect becomes significantly larger than anticipated by any individual subsystem.
1.2 Recurring Characteristics
| Property | Description |
|---|---|
| Structured Input | Hierarchical or encoded textual information (URLs, HTML, JSON, Intent extras, Markdown…), not arbitrary binary data. |
| Multi-stage Processing | The same logical content traverses multiple independent framework layers. |
| Progressive Amplification | Processing cost increases at successive stages. |
| Shared Infrastructure | Unrelated applications reuse identical Android framework components (libminikin, FragmentManager, TaskPersister, SystemUI…). |
| Non-linear Behaviour | Resource consumption frequently disproportionate to input size. |
| Cross-component Impact | Failures appear far from the original entry point (e.g. browser click → SystemUI crash). |
1.3 General Amplification Pipeline
Structured Input (URL / HTML / Intent / Clipboard / Deep Link)
↓
Parser / Validation
↓
Framework APIs
↓
Binder IPC
↓
Rendering Engine (TextView → StaticLayout → LineBreaker → libminikin) ← Class B
↓
Layout / Compose
↓
State Persistence (TaskPersister / SavedStateRegistry) ← Class A
↓
SystemUI / OEM recovery
↓
Observed Failure (ANR / Crash Loop / Hard Reboot)
2. Class A vs Class B — Concrete Mechanisms
Table 1. Comparison of the two concrete amplification mechanisms under the STA model. Rows marked “Observed factor” and “Result” are empirical; “Primary fix owner” is a proposed responsibility assignment.
| Class A — IPC / SavedState Amplification | Class B — Interaction Surface Amplification | |
|---|---|---|
| Mechanism | SavedState serialization → Bundle → Parcel → Binder > 1 MB | Synchronous text layout on UI thread (libminikin line breaking) |
| Resource exhausted | Binder transaction buffer (1 048 576 bytes) | Main thread CPU time (ANR threshold ~5 s) |
| Amplification driver | Fragment nesting depth + metadata (architectural) | URL character composition (# / % €) (content-driven) |
| Observed factor | ×2.8 to ×20.6 (WhatsApp field measurement) | 10–20× multiplier before O(n²)/blocking |
| Result | TransactionTooLargeException → permanent crash loop | Main thread block → ANR (5–16 s) |
| Persistence | Yes — until data cleared or reboot | No (unless combined with history / TaskPersister) |
| Primary fix owner | Google / AOSP (FragmentManager + SystemUI + TaskPersister) | Google / AOSP (libminikin) + browser vendors (defense-in-depth) |
Two distinct amplification models that share a common root-cause category (absent input validation before expensive operations), but are not reducible to a single mathematical model. The fix for one does not address the other.
3. Root Cause Detail
This section separates documented platform behaviour (Binder limit, missing catch in restore paths, measured Bundle sizes, native stacks) from the researcher’s interpretation (STA as a unifying pattern) and from proposed mitigations (Section 16).
3.1 What IS “Working as Intended”
The 1 MB Binder limit is intentional. An app storing large data in a Bundle and hitting the limit is a documented consequence of misusing the mechanism — not a vulnerability by itself. This report does not claim the Binder limit or Fragment nesting are bugs.
3.2 The Real Problem — Absent Safe Fallback (Class A)
When FragmentManager.restoreAllState() encounters a Bundle exceeding the Binder limit, Android has no safe degradation mechanism. The TransactionTooLargeException propagates uncaught, the process crashes, and the same oversized state is persisted to disk for the next launch → permanent crash loop the user cannot escape without clearing application data.
// Current Android behaviour — no safe fallback
void restoreAllState(Bundle savedState) {
// No try-catch. TransactionTooLargeException propagates uncaught.
// Same oversized state re-persisted → crash loop on next launch.
fragmentManager.restoreState(savedState);
}
// Recommended — safe degradation
void restoreAllState(Bundle savedState) {
try {
if (isBundleOverLimit(savedState)) {
Log.e(TAG, "SavedState over limit — discarding for safe restart");
return; // clean start — no crash loop
}
fragmentManager.restoreState(savedState);
} catch (TransactionTooLargeException e) {
// safe degradation: app starts as if first launch
}
}
3.3 Empirical Amplification — WhatsApp Android 15 (×20.6)
W/Bundle: childFragmentManager [L1] size=1,636,412 W/Bundle: childFragmentManager [L2] size=1,614,072 W/Bundle: childFragmentManager [L3] size=1,603,852 W/Bundle: registryState size= 479,948 W/Bundle: compose_text (origin) size= 80,484 ← input data W/Bundle: TOTAL size=1,661,088 ← +58% over Binder limit // Binder limit: 1,048,576 bytes · Overflow: +612,512 bytes · Factor: ×20.6
| Input | Fragment depth | Bundle | Factor | Exceeds limit |
|---|---|---|---|---|
| 10,000 bytes | 2 levels | ~28,000 | ×2.8 | No |
| 50,000 bytes | 4 levels | ~275,000 | ×5.5 | No |
| 80,000 bytes | 5 levels+meta | ~1,021,000 | ×12.8 | Near |
| 82,431 bytes | 5 levels+meta | ~1,124,352 | ×13.6 | YES |
| 80,484 bytes | 5 lvls+Meta AI | ~1,661,088 | ×20.6 | YES +58% |
3.4 Class B — libminikin Algorithmic Amplification
Characters with special meaning in URLs force the line-breaking algorithm to evaluate many more break candidates:
# — creates a logical boundary, doubling break decisions / — each slash adds a candidate break point % — expands UTF-8 to UTF-16 and fragments the string € — ambiguous line-break properties force algorithm to explore both options // Combined pattern: %E2%A0%80%E2%82%AC%23 // Multiplies algorithmic cost by 10-20x BEFORE O(n²) or greedy blocking applies
4. Affected Browsers (12 Confirmed)
| Engine family | Browsers |
|---|---|
| Chromium-based | Google Chrome, Microsoft Edge, Microsoft Bing, Opera Browser, DuckDuckGo Browser, Brave Browser, Samsung Internet |
| Gecko-based | Mozilla Firefox, Firefox Focus, Firefox Nightly, Tor Browser |
| Proxy-based | Opera Mini (independently reproduced) |
| Browser | Engine | Confirmed vector(s) | Notified |
|---|---|---|---|
| Google Chrome | Chromium | STA-001, STA-017 (Tier A), STA-020 | Yes — Google VRP |
| Microsoft Edge | Chromium | STA-017 (Tier A), STA-020 | Yes — MSRC |
| Microsoft Bing | Chromium (Sapphire) | STA-013, STA-015-DL | Yes — MSRC |
| Opera Browser | Chromium | STA-016, STA-017 | Yes |
| DuckDuckGo Browser | Chromium | STA-022, STA-022b | Yes — HackerOne |
| Brave Browser | Chromium | STA-021, STA-017 | Yes — HackerOne |
| Samsung Internet | Chromium | STA-023/023b/023c | Documented, not formally notified |
| Mozilla Firefox | Gecko | STA-019a/b/c/d, STA-017 | Yes |
| Firefox Focus / Nightly | Gecko | STA-019 family | Yes — via Mozilla |
| Tor Browser | Gecko | STA-017, STA-019a/b/c | Yes |
| Opera, Opera Mini | Proxy-based | STA-016 | Yes — via Opera |
5. Evidence Taxonomy
| Tier | Criteria | Vectors |
|---|---|---|
| Tier A — Confirmed | Full stack trace + exception + Bundle analysis | STA-005/005b/005c/005d, STA-006, STA-007, STA-009, STA-010/010b, STA-011, STA-012/012e, STA-015, STA-015b, STA-015-DL, STA-016, STA-017 Chrome+Firefox, STA-018, STA-019a/b/c/d, STA-022 |
| Tier B — Behavioral | Crash/ANR observed; mechanism inferred by analogy | STA-001, STA-003, STA-004, STA-008, STA-013, STA-020, STA-021, STA-022b, STA-023/023b/023c |
| Tier C — Mitigated | Tested; no crash — positive control | YouTube (all scenarios) |
6. STA-017 — Cross-Engine ANR: Tier A Evidence
Evidence (observed): STA-017 upgraded to Tier A for BOTH Chrome (Chromium) AND Firefox (Gecko). Blocking call: libminikin.so::LineBreakOptimizer::computeBreaks. This is an Android system library — not Chromium or Gecko code.
6.1 Chrome — Full Native Stack Trace (bugreport 2026-05-24)
Listing 1. Native main-thread stack from production bugreport (Xiaomi Redmi Note 14 5G, Android 16).
Device: Xiaomi Redmi Note 14 5G · HyperOS 3.0 · Android 16. Chrome versionCode 777818033. Two ANR files, identical stack.
// ANR 1 — 2026-05-24 13:38:44 — Chrome PID 3533 // Waited 5000ms for MotionEvent — ChromeTabbedActivity "main" prio=5 tid=1 Native ← UI THREAD BLOCKED native: minikin::getPrevWordBreakForCache libminikin.so native: minikin::LayoutCacheKey::LayoutCacheKey libminikin.so native: minikin::LayoutCache::getOrCreate libminikin.so native: minikin::StyleRun::getLineMetrics libminikin.so native: minikin::MeasuredText::getLineMetrics libminikin.so native: minikin::LineBreakOptimizer::computeBreaks ← O(n²) on long URL native: minikin::breakLineOptimal libminikin.so native: android::nComputeLineBreaks libhwui.so at android.graphics.text.LineBreaker.nComputeLineBreaksWithHelperIndex (Native) at android.text.StaticLayout.generate (StaticLayout.java:970) at android.text.StaticLayout$Builder.build (StaticLayout.java:550) at android.widget.TextView.makeSingleLayout (TextView.java:11263) at android.widget.TextView.onMeasure (TextView.java:11486) at android.widget.ListView.onMeasure (ListView.java:1321) at org.chromium.chrome.browser.contextmenu.ContextMenuListView.onMeasure ↑ CHROME CONTEXT MENU — long-press on oversized URL link at android.view.ViewRootImpl.performTraversals at android.app.ActivityThread.main
6.2 Firefox — Full Native Stack Trace (bugreport 2026-06-12)
Process: org.mozilla.firefox (PID 3506). Activity: ExternalAppBrowserActivity. Duration: 16,006 ms. Trigger: REAL Gmail link (not a controlled test).
// org.mozilla.firefox PID 3506 — ANR 2026-06-10 19:42:19 — 16,006ms "main" prio=5 tid=1 Native ← UI THREAD BLOCKED 16,006ms native: minikin::LayoutCacheKey::LayoutCacheKey+120 libminikin.so native: minikin::LayoutCache::getOrCreate libminikin.so native: minikin::LayoutPieces::getOrCreate libminikin.so native: minikin::StyleRun::getLineMetrics libminikin.so native: minikin::MeasuredText::getLineMetrics libminikin.so native: minikin::LineBreakOptimizer::computeBreaks+1752 ← O(n²) native: minikin::breakLineOptimal+476 libminikin.so native: android::nComputeLineBreaks+356 libhwui.so at android.graphics.text.LineBreaker.nComputeLineBreaksWithHelperIndex (Native) at android.text.StaticLayout.generate / Builder.build at android.widget.TextView.onMeasure at org.mozilla.fenix.customtabs.ExternalAppBrowserActivity URL rendering
| Attribute | Chrome (Chromium) | Firefox (Gecko) |
|---|---|---|
| Native entry | libminikin::LineBreakOptimizer::computeBreaks | libminikin::LineBreakOptimizer::computeBreaks |
| ANR duration | 5,000ms+ (threshold) | 16,006ms (3× longer) |
| Trigger | Controlled test | REAL Gmail email link |
| Tier | Tier A | Tier A |
6.3 Additional Entry Points Confirmed (June 2026)
| Bugreport | App | Trigger | minikin function | Entry point |
|---|---|---|---|---|
| 2026-05-24 | Chrome | Long-press on link | breakLineOptimal | ContextMenuListView.onMeasure |
| 2026-06-10 | Firefox | Real Gmail link | breakLineOptimal | ExternalAppBrowserActivity |
| 2026-06-24 | Edge | SystemUI crash → omnibox re-layout | breakLineOptimal | OmniboxSuggestionsContainer |
| 2026-06-28 | Google App | android.intent.action.TRANSLATE | breakLineGreedy | DynamicLayout$ChangeWatcher.onTextChanged |
Critical: breakLineGreedy is also vulnerable to blocking on long text. The naive “switch to greedy” fix is incomplete. A hard length threshold before either algorithm runs is required.
Reproduction steps (STA-017 — Chrome context menu)
- Create an HTML page containing a hyperlink whose
hrefis a syntactically valid URL of approximately 80–120 KB with high density of#,/and%characters. - Host or open the page in Chrome on Android 13–16.
- Long-press the link until the context menu appears.
- Observe main-thread ANR (typically ≥ 5 000 ms). Capture via
adb bugreport; native stack showslibminikin::LineBreakOptimizer::computeBreaks.
Equivalent behaviour has been observed with real-world Gmail links (Firefox, 16 006 ms) and SystemUI-triggered omnibox re-layout (Edge).
6b. STA-027 — Edge Ask Copilot Deep Link Amplification ★NEW
| STA Identifier | STA-027 |
| Category | Intent / Compose Navigation Amplification (Class A + Class B) |
| Affected Component | Microsoft Edge Ask Copilot (com.microsoft.copilotn) |
| Impact | Crash / navigation failure via deep link with oversized initialText |
| CVSS 3.1 | 6.5 |
| Persistence | Yes (until data cleared / conversation state reset) |
| Tier | A ★NEW |
STA-027 demonstrates simultaneous Class A and Class B behaviour inside Microsoft Edge’s Ask Copilot deep-link navigation path. An oversized structured payload supplied in the initialText query parameter is accepted by the deep-link handler and forwarded into Jetpack Compose Navigation. The resulting route string exceeds the expected structure of the NavGraph, producing an uncaught IllegalArgumentException.
java.lang.IllegalArgumentException: navigation destination com.microsoft.copilotn.features.deeplink.navigation.routes.HomeNavRoute.ChatNavRoute? conversation_id=null&private_mode_chat=false&conversationTitle=null&initialText=ULTRA%20DESTRUCTIVE%20LAYOUT%20ATTACK... is not a direct child of this NavGraph at androidx.navigation.compose.c.a (NavGraph.kt:356) at com.microsoft.copilotn.features.deeplink.navigation.routes.HomeNavRoute.ChatNavRoute
The oversized initialText value simultaneously:
- Triggers expensive text layout / measurement work (Class B amplification path) when the destination attempts to render or pre-process the parameter.
- Breaks Compose Navigation graph resolution because the fully-expanded route is no longer recognised as a direct child of the NavGraph (Class A style state / routing failure).
Remote activation: Unlike STA-017 (which requires a long-press or local UI interaction inside an already-open browser), STA-027 can be triggered remotely by a malicious deep link that opens Edge Ask Copilot with a crafted initialText parameter. No prior interaction with the Copilot UI is required beyond following the link.
Reproduction steps (STA-027)
- Construct a deep link targeting Microsoft Edge Ask Copilot that includes an oversized
initialTextquery parameter (structured text large enough to expand the Compose navigation route beyond NavGraph expectations). - Open the link from another app or browser (ACTION_VIEW / deep link).
- Observe uncaught
IllegalArgumentExceptionfromandroidx.navigation.compose(NavGraph.kt) when resolvingHomeNavRoute.ChatNavRoute. - Capture logcat / bugreport; confirm stack includes the navigation destination containing the expanded
initialText.
7. AOSP Commit Evidence
7.1 Chromium Commit 3e62ece6 — LargePayloadSupport (May 7, 2026)
Commit: chromium.googlesource.com/chromium/src/+/3e62ece6
Commit message (verbatim):
“Implements ResultReceiver for large payloads in DigitalCredentialsPresentationDelegate to avoid TransactionTooLargeException when responses exceed Binder IPC limits. This aligns with updates in Jetpack libraries (AOSP CL 3989977) where large payloads are passed via file descriptors.”
1. Explicitly names TransactionTooLargeException — same as ALL Class A vectors.
2. References AOSP CL 3989977 (LargePayloadSupport) — internal, not public.
3. Fix: file descriptors instead of Binder.
4. Google named this: LargePayloadSupport.
Related historical trackers:
- Google Issue Tracker 40879254 (2022): issuetracker.google.com/issues/40879254
- Google Issue Tracker 40268979 (Samsung 2023): issuetracker.google.com/issues/40268979
- AOSP minikin repository: android.googlesource.com/platform/frameworks/minikin/
7.2 androidx.savedstate 1.5.0 — Bug #425919375
| Date | Event | T+ VRP |
|---|---|---|
| Jun 19, 2025 | Bug #425919375 created — SavedState serialization | — (inactive 7 months) |
| Jan 20, 2026 | VRP submission to Google Android VRP | T+0 |
| Feb 10, 2026 | Google responds for FIRST time | T+21 days |
| Mar 4, 2026 | Commit: Support generic serialization for SavedState | T+43 days |
| Mar 11, 2026 | Bug Fixed — savedstate 1.5.0-alpha01 | T+50 days |
| May 19, 2026 | savedstate 1.5.0 STABLE — CBOR/JSON decoupled from Binder | T+119 days |
savedstate 1.5.0 decouples SavedState from the Bundle/Binder pipeline — an architectural fix for part of the Class A root cause. Bug inactive 7 months. Reactivated 21 days after VRP. Fixed in ~30 days. Google framed it as “multiplatform support” — no security motivation mentioned publicly.
7.3 libminikin design debt — multi-file pipeline (AOSP forensic summary)
Independent AOSP source review identifies a systemic design gap across multiple minikin files: no length validation before expensive line-breaking or layout work. Oldest relevant code paths date to 2013. Key files:
| File | Since | Issue | Function |
|---|---|---|---|
| FontFamily.cpp | 2013 | Null / closest-match edge cases | getClosestMatch() |
| Layout.cpp | 2013 | Long text processed without cache guard | doLayoutWord() |
| OptimalLineBreaker.cpp | 2015 | Knuth-Plass O(n²) without input limit | computeBreaks() |
| GreedyLineBreaker.cpp | 2017 | Nested loops; worst-case costly | processLineBreak() |
| LineBreaker.cpp | 2018 | Chooses Optimal/Greedy with no size check | breakIntoLines() |
| LayoutCache.h | 2018 | Over CHAR_LIMIT_FOR_CACHE → direct process (no cache) | getOrCreate() |
LineBreaker::breakIntoLines() — no textBuffer.size() guard
↓
Optimal / Greedy breaker — O(n²) / nested work on long input
↓
Layout::doLayoutWord()
↓
LayoutCache::getOrCreate() — long ranges bypass cache → full work
↓
HarfBuzz shaping
↓
UI thread blocked (5–16 s ANR)
Public Issue Tracker history (examples): #161830416, #167014931, #188985643, #40268980 / Chromium 1447465 (Samsung engineer ANR), #477202817 (Won’t Fix), #524288518 (out of scope), #531319203 (related pattern). Structural length limits were not applied across the pipeline as of the July 2026 bulletin, despite the existence of internal Google work addressing an adjacent root cause (AOSP CL 3989977, LargePayloadSupport).
Detail: libminikin: 10 años de vulnerabilidad · Algorithmic DoS en libminikin.so
8. Field Evidence — Android 16, Production Device
8.1 STA-015 — 85 SystemUI Crashes in 4 Days (bugreport 2026-05-26)
Device: Xiaomi Redmi Note 14 5G · HyperOS 3.0.3.0 · Android 16. Crash loop reproduced spontaneously during normal device use.
// SystemUI crash at bootstrap android.os.BadParcelableException: Failure retrieving array; only received 1 of 4 at android.content.pm.BaseParceledListSlice.<init>(BaseParceledListSlice.java:111) at android.window.ITaskOrganizerController$Stub$Proxy.registerTaskOrganizer(...) at android.window.TaskOrganizer.registerOrganizer(TaskOrganizer.java:76) at com.android.wm.shell.sysui.ShellInit.init(...) ← crash at bootstrap Caused by: android.os.DeadObjectException: Transaction failed on small parcel
| Total SystemUI crashes | 85 entries — 4 days (May 23–26, 2026) |
| Fastest loop | 16 crashes in 92 seconds |
| Min survival time | 374 ms — crashes before any UI renders |
| Android version | Android 16 — first confirmed reproduction |
8.2 STA-015b / STA-015-DL — HyperOS Auto-Re-Trigger (12-step flow)
STEP 1: User opens HTML from Google Drive, clicks link
STEP 2: Browser receives malformed URL via VIEW Intent
callingPackage=com.google.android.apps.docs (certified by Android OS)
STEP 3: libminikin O(n²) ANR in browser
STEP 4: URL corrupts TaskPersister state on disk
STEP 5: SystemUI reads corrupt state → BadParcelableException → CRASH
STEP 6: Android auto-restarts SystemUI
STEP 7: OEM Task State Interactor (HyperOS OEM) subscribes Flow:
getFocusedRootTaskInfo() → reads SAME corrupt disk state → CRASH AGAIN
STEP 8: Crash loop → Android forced to clear SystemUI data → LOCKSCREEN
STEP 9: User enters PIN/pattern/fingerprint
STEP 10: Android restores session → BROWSER RETURNS TO FOREGROUND
STEP 11: OEM Task State Interactor reads task state → browser is active
→ reads still-corrupt TaskPersister state → SECOND CRASH LOOP
STEP 12: NO ADDITIONAL USER ACTION REQUIRED — crash re-triggers automatically
// Recovery: force reboot + clear browser data
STA-015-DL on HyperOS re-triggers AUTOMATICALLY after lockscreen unlock. No additional user action is required after the initial click. A single reboot may not be sufficient if the browser relaunches with the same corrupt state.
9. Complete Vector Catalog — 32 Vectors
Table 2. Documented STA vectors. CVSS scores are researcher estimates (see methodology note under the table). Tier A = full stack / exception evidence; Tier B = behavioural / analogy.
| ID | App / Component | CVSS | Persist | Tier |
|---|---|---|---|---|
| STA-015-DL | Google Drive + Any Browser → SystemUI crash loop (hard reboot) | 8.6 | Reboot only | A |
| STA-018 | Google Drive + Print Service + SystemUI — ANR cascade | 7.5 | Until reboot | A |
| STA-010 | SystemUI / Print Service — Drive → local printer | 7.2 | Until reboot | A |
| STA-011 | SystemUI / Clipboard — paste preview crash | 7.2 | Until reboot | A |
| STA-015 | WindowManager Shell / RecentTasksController | 7.2 | Auto-restart→lockscreen | A |
| STA-015b | HyperOS / OEM Task State Interactor (Xiaomi OEM) | 7.2 | Auto-recovery | A |
| STA-012 | Threads (Meta) — deep link /search?q=[payload] | 7.1 | Permanent (pm clear) | A |
| STA-012e | Threads via WhatsApp — HTML/WebView → Threads deep link | 7.1 | Permanent (pm clear) | A |
| STA-019a | Firefox — ClipboardManager DeadSystemException on address bar focus | 6.8 | Every focus event | A |
| STA-008 | System services — sync IPC call + oversized payload → ANR | 6.8 | Until app killed | B |
| STA-005d | WhatsApp deep link api.whatsapp.com/send?text=[payload] | 6.8 | Possible | B |
| STA-017 | 6+ browsers — long-press URL → libminikin ANR (Chrome+Firefox Tier A) | 6.5 | No | A |
| STA-027 | Microsoft Edge Ask Copilot — deep link initialText NavGraph crash ★NEW | 6.5 | Yes | A ★ |
| STA-005 | WhatsApp — paste large text in chat compose field | 6.5 | Permanent | A |
| STA-005b | WhatsApp Business — all agents in shared inbox | 6.5 | Permanent (all agents) | A |
| STA-005c | WhatsApp + Meta AI — oversized draft in AI chat | 6.5 | Permanent (entire app) | A |
| STA-006 | Google App — Select text → Translate | 6.5 | Permanent | A |
| STA-007 | Google Drive — invisible PDF → Select All → Translate | 6.5 | Permanent | A |
| STA-009 | Google Drive — large DOCX → Print Preview | 6.5 | Permanent | A |
| STA-010b | Google Play Services — Drive → cloud printer | 6.5 | Until app closed | A |
| STA-016 | Opera Browser — onResume → RuntimeException: Failure from system | 6.5 | Permanent | A |
| STA-019d | Firefox — address bar TextLayout lineIndex OOB | 6.5 | Every focus event | A |
| STA-020 | Chrome + Edge — address bar history pipeline ANR | 6.5 | Until history cleared | B |
| STA-021 | Brave Browser — address bar ANR / rendering anomaly | 6.5 | Until history cleared | B |
| STA-022 | DuckDuckGo — URL_EXTRA_ARG 920KB in Fragment args (965KB parcel) | 6.5 | Until tab closed | A |
| STA-022b | DuckDuckGo — history suggestion pipeline ANR (cross-session) | 6.5 | Until history cleared | B |
| STA-013 | Microsoft Bing — contaminated address bar history crash | 6.0 | Until data cleared | B |
| STA-019b | Firefox — SearchDialogFragment IllegalStateException | 6.0 | Every focus event | A |
| STA-019c | Firefox — Compose TextLayout lineIndex OOB (Jetpack Compose) | 6.0 | Every focus event | A |
| STA-023/b/c | Samsung Internet — background tab / Share / tab group freeze | 5.4 | No | B |
| STA-004 | Google Maps — oversized geo: URI | 4.8 | Partial | B |
| STA-001/003 | Chrome / Browsers — long-press context menu, Share link | 3.7 | No | B |
CVSS methodology note: CVSS 3.1 scores are researcher estimates. For STA-015-DL the vector used is AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H (8.6). Other scores follow analogous reasoning (remote or local delivery, user interaction, availability impact, and whether scope changes to SystemUI). Scores are subject to vendor revision.
9b. Impact Matrix (Qualitative)
Table 3. Qualitative impact summary by vector group (researcher assessment; complements CVSS in Table 2).
| Vector group | Availability | Persistence | User interaction | Attack complexity | Notes |
|---|---|---|---|---|---|
| STA-015-DL / SystemUI | High (device UI) | Yes (reboot) | One click | Low | Scope Changed; hard reboot |
| STA-010/011 Print/Clipboard | High (SystemUI) | Yes (until reboot) | Print / paste | Low | System service path |
| STA-005 WhatsApp family | High (app / shared inbox) | Yes (delete chat) | Paste / open chat | Low | ×20.6 Bundle amplification |
| STA-012 Threads | High (app) | Yes (pm clear) | Deep link click | Low | Permanent until data clear |
| STA-017 libminikin ANR | Medium (ANR 5–16 s) | No | Long-press / focus | Low | Cross-engine; framework lib |
| STA-027 Edge Ask Copilot | Medium–High (crash) | Yes | Deep link click | Low | Remote; Compose NavGraph |
| STA-019 Firefox address bar | Medium | Yes (every focus) | Focus address bar | Low | Repeated until history cleared |
| STA-020/021/022 browsers | Medium | Partial | Focus / history | Low | History pipeline |
10. STA-005 — WhatsApp Variants
| Affected component | FragmentManager.restoreAllState() — AndroidX |
| Trigger | Bundle.dataSize() > 1,048,576 bytes during state restoration |
| Current behavior | TransactionTooLargeException uncaught → crash → state re-persisted → loop |
| Expected behavior | Exception caught → state discarded → clean start → no loop |
| Reproducibility | 100% — Pixel 7, Xiaomi Redmi 14, OPPO A78, OnePlus 11 (Android 13–16) |
| Confirmed apps | WhatsApp, WhatsApp Business, Meta AI, Threads, Bing, Opera, DuckDuckGo, Firefox |
| CVSS 3.1 | 6.5 — AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
STA-005b (WhatsApp Business): When a conversation’s SavedState becomes contaminated, the crash loop affects ALL agents in a shared inbox simultaneously. The only recovery (deleting the conversation) destroys the entire communication history with that client.
STA-005c (WhatsApp + Meta AI): Oversized draft in AI chat can lock the entire application permanently.
11. STA-015 Series — SystemUI Vectors
These vectors extend Class A amplification into privileged system components. Impact is no longer confined to a single app.
| Vector | Trigger | Mechanism | CVSS |
|---|---|---|---|
| STA-010 | Google Drive document → Print → local printer | Print Service builds preview Bundle from oversized text; exceeds Binder when handed to SystemUI | 7.2 |
| STA-010b | Drive → cloud/network printer | Same root mechanism routed through Play Services | 6.5 |
| STA-011 | Copy oversized clipboard → focus text field with assisted-paste | Clipboard assisted-paste preview serializes full ClipData instead of truncated snippet | 7.2 |
| STA-015 | Opening recent apps / task list | RecentTasksController reads corrupt task state → DeadSystemException → SystemUI crash → lockscreen | 7.2 |
| STA-015b | HyperOS after SystemUI restart | OEM Task State Interactor re-reads corrupt state → automatic re-crash | 7.2 |
| STA-015-DL | Google Drive HTML link → any browser | Full remote chain (see section 8.2). Hard reboot required. Scope Changed. | 8.6 |
CVSS 3.1 for STA-015-DL: AV:N / AC:L / PR:N / UI:R / S:C / C:N / I:N / A:H = 8.6 HIGH. Remote, single click, changes scope to SystemUI, high availability impact.
12. STA-019 — Firefox: Four Failure Modes
- STA-019a — ClipboardManager DeadSystemException on every address-bar focus (CVSS 6.8)
- STA-019b — SearchDialogFragment IllegalStateException (CVSS 6.0)
- STA-019c — Jetpack Compose TextLayout lineIndex out-of-bounds (CVSS 6.0)
- STA-019d — address-bar TextLayout lineIndex OOB (CVSS 6.5)
All four can fire on every focus event once history/state is contaminated, producing a persistent unusable address bar.
13. STA-020 / 021 — Chrome / Edge / Brave Address-Bar Pipeline
History suggestion pipeline retains oversized URLs. Subsequent focus or suggestion rendering re-enters libminikin or causes ANR. Chromium applied a partial display-only truncation in 2023 that never covered the loading/history path — STA-020 still reproduces through the unpatched path.
14. STA-022 — DuckDuckGo
STA-022: URL_EXTRA_ARG of ~920 KB stored in Fragment arguments produces a 965 KB parcel → TransactionTooLargeException (Tier A). STA-022b: history suggestion pipeline ANR that survives across sessions until history is cleared.
15. Cross-Platform Validation — iOS Not Affected
Same payload does NOT crash Threads for iOS. Same app, same 20 000-character deep link, zero crash on iOS. Failure is isolated to Android-specific components: Binder (1 MB limit), TaskPersister, FragmentManager.restoreAllState(). The fix must come from Google / AOSP.
16. Recommended Fixes
Proposed mitigations (not observed factory behaviour). Code samples below are suggestions for framework and application owners; they have not been merged upstream as of the July 2026 bulletin.
16.1 Framework — Class B (libminikin)
Listing 2. Proposed length thresholds before Optimal/Greedy line breaking.
// CORRECTED FIX — LineBreakOptimizer.cpp (libminikin.so)
// Previous “switch to greedy only” is incomplete: breakLineGreedy also blocks.
LineBreakResult LineBreakOptimizer::computeBreaks(...) {
const int textLength = end - start;
// THRESHOLD 1 (HARD): Truncate before any algorithm runs.
// Neither algorithm produces useful results for text > 8 KB of URL/text.
if (textLength > MAX_SAFE_TEXT_LENGTH_ABSOLUTE) {
end = start + MAX_SAFE_TEXT_LENGTH_ABSOLUTE;
}
// THRESHOLD 2: Prefer O(n) greedy for medium-length text.
if ((end - start) > MAX_SAFE_TEXT_LENGTH_FOR_OPTIMIZER) {
return computeBreaksGreedy(measured, start, end, constraints);
}
return computeBreaksOptimal(measured, start, end, constraints);
}
// Units are UTF-16 code units (Java/Android char), NOT bytes.
static const int MAX_SAFE_TEXT_LENGTH_ABSOLUTE = 8192; // hard truncate
static const int MAX_SAFE_TEXT_LENGTH_FOR_OPTIMIZER = 2048; // switch to greedy
16.2 Framework — Class A (FragmentManager / SystemUI)
- Catch TransactionTooLargeException inside FragmentManager.restoreAllState() and start clean.
- Validate derived state size before persistence (TaskPersister, SavedStateRegistry).
- SystemUI and OEM components must treat restored task lists as potentially toxic and degrade gracefully (do not crash the whole UI process).
16.3 Application-level (immediate workarounds)
// Truncate any text displayed in a TextView
public static String safeForTextView(String text) {
final int MAX = 8192;
if (text == null) return null;
return text.length() > MAX ? text.substring(0, MAX) + "..." : text;
}
// Reject oversized VIEW Intents
if (Intent.ACTION_VIEW.equals(intent.getAction())) {
Uri data = intent.getData();
if (data != null && data.toString().length() > 50_000) {
Log.w(TAG, "Incoming VIEW Intent URL exceeds safe length — discarding");
finish();
return;
}
}
Coverage warning for CISOs: Updating to androidx.savedstate 1.5.0 does NOT protect against STA-015-DL (SystemUI), STA-015/015b, STA-017 (libminikin) or STA-019 (Firefox pipeline). Those require AOSP-level changes that only Google can ship.
16.4 Generic System UI / OEM Resiliency Pattern (STA-015b)
HyperOS component OEM Task State Interactor re-subscribes to task info after SystemUI restart and re-reads corrupt state. Safe degradation on DeadObjectException prevents the automatic second crash loop:
// STA-015b — Xiaomi / HyperOS OEM fix
// OEM Task State Interactor: safe degradation when TaskManager is dead
val focusedTaskFlow = interactor.getFocusedRootTaskInfoFlow()
.catch { exception ->
if (exception is DeadObjectException) {
Log.e("SystemUI", "TaskManager service is dead. Resubscribing later.")
emit(null) // Safe degradation — do not crash SystemUI
} else {
throw exception
}
}
17. Vendor Notification Status
| Vendor | First notification | Response / validation | Patch status (Jul 2026) |
|---|---|---|---|
| Xiaomi | 2026 | Reproduced, confirmed, rewarded | OEM-side mitigation feasible |
| Google (Android VRP) | Jan 20, 2026 | Multiple reports; mixed outcomes; savedstate 1.5.0 progress | No public STA patches in Jul bulletin |
| Microsoft (MSRC) | Jan / Jun 2026 | Individual cases (Edge, Bing, Ask Copilot STA-027) | Pending |
| Mozilla | 2026 | Reports submitted (Firefox family) | Pending |
| Opera / Brave / DuckDuckGo / Tor | 2026 | Reports submitted; classifications vary | Pending |
| Samsung | — | Documented only (no public VRP for this class) | — |
| INCIBE (CNA Spain) | Jul 2026 | Referred to MITRE (CNA Root for Google). Technical reports and PoCs submitted. | All STA vectors |
18. Disclosure Timeline
Research span: 2022 → 30 July 2026. Primary laboratory device: Xiaomi Redmi Note 14 5G (HyperOS 3.0 / Android 16). Much of the AOSP path analysis was performed from a phone browser reading public source, without a traditional multi-monitor lab setup.
18.1 2022 — Origin
| Date | Milestone |
|---|---|
| 28 Aug 2022 | Original discovery: TransactionTooLargeException / DeadSystemException in Firefox Focus & Nightly (clipboard, share, open-in-app) |
| 12 Oct 2022 | First public advisory: “Mozilla Firefox Focus and Nightly for Android Remote Crash DoS” (lostmon.blogspot.com) |
| Nov 2022 | Chromium Issue 40879254 opened; security labels removed; partial UX patch; issue remained open |
| Nov 2022 | Mozilla Bugzilla #1802594 (S3) opened — still NEW / unresolved as of 2026 |
18.2 January–April 2026 — Formal investigation
| Date | Milestone |
|---|---|
| 20 Jan 2026 | Formal reports to Google Android VRP (A-477279924) and Microsoft MSRC. Case A-477279924 received a $250 VRP reward for the Binder/IPC research area and remained open / blocked on internal dependency as of mid-2026. (A separate Chrome VRP filing, Issue 477202817, was closed the same day as “Won’t Fix (Intended Behavior)”.) |
| Feb 2026 | Whitepaper v4 distributed (27 vectors); STA-015-DL (CVSS 8.6) and STA-015b added |
| Mar 2026 | Meta (WhatsApp/Threads) notified — no response (113+ days by July) |
18.3 May–June 2026 — Field evidence
| Date | Milestone |
|---|---|
| 24 May 2026 | Chrome bugreport: 2 full native ANRs → STA-017 Tier A (libminikin) |
| 26 May 2026 | SystemUI: 85 crashes in 4 days on Android 16 (first confirmed) |
| 31 May 2026 | STA-015-DL remote attack confirmed via Google Drive (callingPackage=com.google.android.apps.docs) — 6 browsers |
| 10 Jun 2026 | Vendor notifications: Mozilla, Opera, DuckDuckGo, Brave, Tor, Xiaomi (HackerOne) |
| 10 Jun 2026 | Firefox ANR 16 006 ms (real Gmail link) → STA-017 Firefox Tier A |
| 14 Jun 2026 | MSRC responds; requests separate cases; defers framework root cause to Google |
| 15 Jun 2026 | Google closes libminikin-specific report (524288518) as “out of scope” — months after $250 reward |
| 16 Jun 2026 | Appeal for STA-015-DL citing CVE-2023-21167 / A-259942964; Opera classifies P5 Informational |
| 19 Jun 2026 | Brave rejects as “upstream / DoS out of scope” |
| 20 Jun 2026 | Second spontaneous SystemUI crash loop; Edge ANR 25 s later → STA-017 Edge Tier A |
| 24 Jun 2026 | Three separate MSRC cases filed; blog posts: STA framework + Algorithmic DoS in libminikin |
| 28 Jun 2026 | Google App: 5 ANR + 3 TransactionTooLargeException in 14 min; breakLineGreedy also vulnerable; first simultaneous Class A+B |
| 30 Jun 2026 | No public AOSP/Chromium/AndroidX commits addressing documented vectors; June bulletin empty for STA |
18.4 July 2026 — Countdown to disclosure
| Date | Milestone |
|---|---|
| 5 Jul 2026 | Google Issue #531319203 opened (system_server boot loop / BitmapCache — same architectural pattern) |
| 6 Jul 2026 | July Android Security Bulletin published — zero patches for any STA vector |
| 10 Jul 2026 | Blog: “libminikin: 10 años de vulnerabilidad”; Xiaomi device still vulnerable after June patch |
| 11 Jul 2026 | Mozilla Bugzilla #2046725 opened for Firefox family |
| 16 Jul 2026 | Xiaomi confirms vulnerability and awards bounty ($300 via HackerOne) |
| Jul 2026 | STA-027 (Edge Ask Copilot) documented; INCIBE (CNA Spain) reviewed the case and referred it to MITRE for CVE assignment |
| 30 Jul 2026 | Public whitepaper disclosure — lostmon.blogspot.com |
July 2026 Security Bulletin — zero mitigation. Google has not released the internal fix (LargePayloadSupport, AOSP CL 3989977) to the public branch as of the disclosure date. The $250 VRP reward for the Binder/IPC research area stands in contrast to the later “out of scope” classification of the related libminikin report.
Full narrative timeline and related articles: Timeline STA · Research story · libminikin 10 years · Algorithmic DoS · STA framework
19. Glossary
| Term | Definition |
|---|---|
| STA | Structured Text Amplification — architectural pattern of progressive resource amplification from structured textual input. |
| Class A | IPC / SavedState amplification: Bundle exceeds Binder limit → crash loop. |
| Class B | Interaction-surface amplification: libminikin line-breaking blocks UI thread → ANR. |
| Binder | Android IPC mechanism; hard transaction limit 1 048 576 bytes. |
| TaskPersister | Framework component that persists task/activity state to disk for restoration. |
| SavedState / FragmentManager.restoreAllState() | AndroidX/AOSP path that restores Fragment hierarchy from a Bundle after process death. |
| libminikin | Native Android text layout library (line breaking, measurement); used by TextView and others. |
| LineBreakOptimizer::computeBreaks | Optimal (often O(n²)) line-breaking path inside libminikin. |
| SystemUI | Privileged process that owns status bar, navigation bar, lockscreen, recent tasks. |
| OEM Task State Interactor | Xiaomi HyperOS OEM component that re-subscribes to task focus state after SystemUI restart. |
| LargePayloadSupport | Internal Google/AOSP work (CL 3989977) to pass large payloads via file descriptors instead of Binder. |
| TransactionTooLargeException | Exception thrown when a Parcel/Binder transaction exceeds the 1 MB limit. |
| ANR | Application Not Responding — main thread blocked beyond the watchdog threshold (~5 s). |
| NavGraph (Compose) | Jetpack Compose Navigation graph; routes must be direct children of the declared graph. |
20. Limitations and Future Work
- Research conducted on production consumer devices; no privileged access to proprietary vendor source beyond AOSP.
- Exact behaviour varies with Android version, OEM customisations, available memory and security patches.
- Not every documented vector has received independent vendor confirmation.
- STA is proposed as a working architectural model derived from empirical observations. Its ultimate validity depends on independent reproduction and critical review.
20.1 Future work
- Formal mathematical modelling of amplification thresholds (Class A nesting depth vs Bundle size; Class B character-composition cost).
- Automated detection of STA-style execution paths (static analysis + dynamic instrumentation).
- Broader cross-platform comparison (further iOS controls; other mobile OS text pipelines).
- Upstream-ready patches for libminikin length thresholds and SystemUI safe degradation.
21. Conclusion
What initially appeared to be isolated denial-of-service conditions gradually revealed recurring architectural characteristics shared by otherwise unrelated execution paths. These observations motivated the introduction of the Structured Text Amplification (STA) model.
The primary contributions of this work are:
- Introduction of STA as an architectural framework for analysing structured input propagation across Android.
- Documentation of 32 reproducible vectors spanning Class A (IPC/SavedState) and Class B (libminikin) mechanisms, with full technical evidence.
- Correlation of apparently independent behaviours through execution-path analysis rather than symptom comparison.
- Concrete evidence (native stack traces from production devices, AOSP commit references, field crash statistics) supporting the most severe findings, including remote SystemUI crash loops (CVSS 8.6).
- Proposal of layered defensive strategies that address amplification at the architectural level.
Whether future research confirms, refines or challenges this model, the underlying observations remain reproducible technical evidence.
References
- Chromium commit 3e62ece6 (LargePayloadSupport), May 2026: chromium.googlesource.com/chromium/src/+/3e62ece6
- Google Issue Tracker 40879254 (2022): issuetracker.google.com/issues/40879254
- Google Issue Tracker 40268979 / related Samsung Chrome ANR (2023): issuetracker.google.com/issues/40268979
- AOSP minikin repository: android.googlesource.com/platform/frameworks/minikin/
- androidx.savedstate 1.5.0 / Bug #425919375 (SavedState serialization)
- Android Open Source Project — FragmentManager, TaskPersister, WindowManager Shell
- Android Security Bulletins (historical Minikin resource-exhaustion ANR notes)
- Lostmon — Structured Text Amplification (STA), 23 Jun 2026: lostmon.blogspot.com/2026/06/structured-text-amplification-sta.html
- Lostmon — Algorithmic DoS en libminikin.so, 24 Jun 2026: lostmon.blogspot.com/2026/06/algorithmic-dos-en-libminikinso.html
- Lostmon — libminikin: 10 años de vulnerabilidad, 10 Jul 2026: lostmon.blogspot.com/2026/07/libminikin-10-anos-de-vulnerabilidad-en_0671440346.html
- Lostmon — Timeline investigación STA, 12 Jul 2026: lostmon.blogspot.com/2026/07/timeline-investigacion-sta-estilos.html
- Lostmon — Desafiar Android desde el sofá, 17 Jul 2026: lostmon.blogspot.com/2026/07/desafiar-android-desde-el-sofa-y-un.html
Appendix I — Additional External Corroboration (July 2026)
Google has publicly acknowledged, across multiple Android version cycles (4.4.2, 7.1, 8.1, 9.0), that Minikin is vulnerable to resource-exhaustion ANR triggered by attacker-controlled text content. The phenomenon matches the general failure category documented throughout this paper (STA-017 and related vectors).
An independent Chinese-language technical article (Volcengine, May 2026) describes the same practical symptom from an application-developer perspective and recommends truncating input to a bounded size in the 8–32 KB range — consistent with the 8192 UTF-16 code-unit threshold proposed here.
androidx.savedstate 1.5.0 addresses part of Class A for AndroidX consumers but does not cover SystemUI, TaskPersister, libminikin or OEM layers. The most severe vectors still require AOSP-level changes.
CNA referral note (INCIBE → MITRE). On July 14, 2026, INCIBE (Spain's national CSIRT and CVE Numbering Authority) was contacted for CVE assignment across the STA vectors documented in this paper. After internal review, INCIBE formally responded that the affected components fall under MITRE's jurisdiction as the CNA Top-Level Root for the Google ecosystem, and referred the case accordingly. The full whitepaper and supporting evidence are being submitted to MITRE upon public disclosure (July 30, 2026).
Note on external PoC activity. The researcher has been made aware of a public proof-of-concept tracked as CVE-2026-10702, reportedly addressing a related class of Android text-rendering denial-of-service behaviour. This paper has not independently verified the technical content of that CVE record or confirmed a direct mechanism overlap with the STA-017 vectors documented here. It is noted for context as a potential independent data point on the broader visibility of this vulnerability class, not as corroborated evidence within this paper's chain of proof.
Appendix II — Vendor Conduct & Acknowledgements: Xiaomi
While many vendors either dismissed the reports through procedural classifications or ignored them entirely, Xiaomi demonstrated that it is entirely possible to:
- Recognize a systemic issue without disclaiming responsibility.
- Deploy OEM-level mitigations while awaiting upstream fixes from AOSP.
- Value and support the work of independent security researchers.
- Conduct responsible disclosure with transparency, professionalism, and technical competence.
Acknowledgements
High-level vector behavior for STA-015 and STA-015b is documented in this paper for architectural completeness. However, specific internal component names, proprietary code traces, and exact patch implementations have been intentionally withheld out of respect for Xiaomi's internal patching process and in accordance with responsible disclosure agreements.
The researcher wishes to express sincere appreciation to Xiaomi's Security Team for their professionalism, technical rigor, and commitment to protecting their user base.
Xiaomi demonstrated that it is possible to do the right thing — even when the underlying issue originates beyond your immediate framework layers.
Structured Text Amplification (STA)
Unified Architectural + Full Technical Whitepaper
© 2026 Manuel García Peña (Lostmon)
Public disclosure: 30 July 2026 · lostmon.blogspot.com
Posts
