STA-003 Binder Share Intent TransactionTooLargeException
Structured Text Amplification — Vector 003
This post documents STA-003, a denial-of-service vector in Android browsers where an oversized URL shared via the context menu triggers a TransactionTooLargeException during Binder serialization of the ACTION_SEND Intent, causing an immediate browser crash.
⚠️ Severity: STA-003 is an interactive DoS vector. A single long-press on a crafted link followed by "Share" can crash the browser immediately. No special permissions or privileges are required.
1. Summary
STA-003 describes a denial-of-service condition in Android web browsers when an excessively large URL is shared via the context menu of a link.
The vector is triggered when the user performs a long-press on a link and selects "Share". The browser constructs an ACTION_SEND Intent containing the URL as EXTRA_TEXT. During serialization of the Intent for transfer via Binder, the data size may exceed the Binder transaction limit (approximately 1 MiB). This can result in an unhandled TransactionTooLargeException, causing an immediate browser process termination.
Type: Denial of Service (DoS)
Class: Resource Exhaustion / IPC Serialization Boundary
CWE: CWE-20 — Improper Input Validation; CWE-400 — Uncontrolled Resource Consumption
CVSS v4.0 estimated: 6.5 (Medium)
2. Attack chain
The observed chain can be represented as:
Malicious web page
↓
Excessively large URL
↓
Long-press on the link
↓
Context menu
↓
"Share"
↓
Intent ACTION_SEND
↓
EXTRA_TEXT = URL
↓
Intent serialization
↓
Binder IPC
↓
Parcel > transaction limit
↓
TransactionTooLargeException
↓
Browser crash
↓
Denial of Service
The fundamental characteristic of STA-003 is that a legitimate-looking input — a URL — acquires a disproportionate cost when crossing a serialization/IPC boundary.
3. Difference from STA-001
STA-003 must be kept separate from STA-001.
| Vector | Mechanism | Failure |
|---|---|---|
| STA-001 | Context menu processing | Prolonged processing / freeze before crash |
| STA-003 | ACTION_SEND Intent → Binder serialization |
Immediate crash during Intent serialization |
STA-001 is associated with prolonged processing during context menu construction, with a noticeable freeze before the crash.
STA-003 fails during the Share operation itself:
Long URL
↓
ACTION_SEND
↓
Intent serialization
↓
Binder
↓
TransactionTooLargeException
↓
Immediate crash
4. Required conditions
The attack requires:
- An Android browser that exposes the Share operation for the affected link.
- A page containing a link with a sufficiently large URL to exceed the effective Binder transaction limit.
- The victim performs a long-press on the link.
- The victim selects "Share".
Not required:
- Special Android permissions
- Local access to the device
- Application privileges
- Prior code execution on the device
The URL can be distributed via any channel capable of delivering a link, including web pages, messaging, email, social networks, QR codes, or other URL distribution mechanisms.
5. Browser-specific observations
A relevant observation during the investigation is that the availability of the vector depends on how each browser handles excessively large URLs.
| Browser | Behaviour | Mitigation level |
|---|---|---|
| Google Chrome | Does not present Share option for extremely large URLs | Application-level |
| Microsoft Edge | Equivalent mitigation behaviour | Application-level |
| Opera Browser | Share operation available → TransactionTooLargeException → crash |
No mitigation |
This difference is important because it demonstrates two levels of mitigation:
Application-level mitigation:
Avoid generating/sending an excessively large Intent
Framework-level:
Accept an oversized operation
↓
TransactionTooLargeException
↓
Safe fallback / degradation
The existence of application-level mitigations does not eliminate the underlying condition in the IPC mechanism.
6. Stack trace and evidence
The following stack trace was captured during a Share operation with an oversized URL. The excerpt is abbreviated; irrelevant frames and build-specific details have been omitted.
Share Intent crash
java.lang.RuntimeException: android.os.TransactionTooLargeException: data parcel size 1662976 bytes at android.app.ActivityClient.activityStopped(ActivityClient.java:101) at android.app.servertransaction.PendingTransactionActions$StopInfo.run() at android.app.servertransaction.PendingTransactionActions$StopInfo.run(...) at android.os.Handler.dispatchMessage(Handler.java) at android.os.Looper.loop(Looper.java) at android.app.ActivityThread.main(ActivityThread.java)
Key metric: Parcel size 1,662,976 bytes — exceeds the Binder transaction limit (1,048,576 bytes) by approximately 58%. The crash is immediate, with no observable delay.
Vulnerable code pattern
The following pattern is present in many browsers and apps that implement sharing functionality:
// Browser code (simplified)
Intent shareIntent = new Intent(Intent.ACTION_SEND);
shareIntent.setType("text/plain");
shareIntent.putExtra(Intent.EXTRA_TEXT, url); // ← No size check!
startActivity(Intent.createChooser(shareIntent, "Share via"));
The Android framework provides no guardrails for Intent.putExtra() size, and no automatic truncation or validation is performed before the Intent is serialized for Binder transmission.
7. Impact
The observed impact is a denial of service of the browser:
- Immediate browser crash during the Share operation
- Loss of browsing session
- Interruption of user activity
- Potential repetition of the crash if the operation is re-executed
Unlike STA-001 (which may show a 10-17 second freeze before crash), STA-003 crashes immediately during Intent serialization.
Any application implementing share functionality is potentially vulnerable:
- Web browsers (all vendors)
- Email clients
- Social media apps
- Messaging apps
- Document viewers
- File managers
- Any app with a "Share" button for text/URLs
Estimated affected apps: 10,000+ on Play Store
8. Relationship to Structured Text Amplification
STA-003 belongs to the class of vectors where a legitimate-looking data item crosses a transformation or serialization boundary without a sufficiently early limit.
The pattern can be expressed as:
Small / legitimate input
↓
Transformation / serialization
↓
Structured representation
↓
IPC boundary
↓
Resource limit exceeded
↓
Failure / DoS
In STA-003:
URL ↓ String / EXTRA_TEXT ↓ Intent ↓ Parcel ↓ Binder ↓ TransactionTooLargeException ↓ Browser crash
The vector therefore does not depend solely on the logical size of the URL. The relevant cost is the size of the representation that must ultimately cross the IPC boundary.
9. Proof of Concept
The PoC consists of an HTML page containing a link with an extremely large URL:
<a href="https://example.com/[STA Pattern]">
Test link
</a>
During the investigation, character patterns were used to produce an especially large representation after encoding/serialization transformations. The full payload is not included in this public documentation to reduce the potential for abuse.
Conceptual reproduction:
- Open an affected Android browser (e.g., Opera).
- Access a page containing the prepared link.
- Long-press the link.
- Select "Share".
- Observe the immediate browser crash.
- Logs may show
TransactionTooLargeExceptionwith a parcel size exceeding 1 MB.
10. Evidence and background
The research relates STA-003 to the following background:
- Chromium Issue 40879254 (2022): Issue related to sharing an excessively large URL for Binder.
- Mozilla Bugzilla #1802594: Incidents related to
TransactionTooLargeException/DeadSystemExceptionin Firefox. - Chromium: Changes intended to truncate visible URLs and reduce the size of certain data before subsequent operations.
- Android TransactionTooLargeException: Official documentation of the failure mechanism associated with excessively large Binder transactions.
- Android Intent.ACTION_SEND: Surface used to transfer content that subsequently crosses IPC.
These references constitute independent background that helps establish that the attack surface is not limited to a specific browser implementation.
A relevant observation during the investigationis that Chrome and Edge hide the Share option for extremely large URLs, while Opera does not. This suggests that Chrome's behaviour is a deliberate application-level mitigation rather than a framework-level protection. The difference is important: it demonstrates that application-level mitigations can prevent the crash, but they do not address the underlying framework condition. A malicious payload delivered through an app that lacks such a mitigation (like Opera) still triggers the TransactionTooLargeException and crash. This aligns with Google's documented position that TransactionTooLargeException is a framework constraint, not a security vulnerability. However, the availability of application-level mitigations does not eliminate the underlying risk for apps that do not implement them.
11. Proposed mitigation
11.1. Application-level mitigation
The browser should check the URL size before constructing the Intent that will be transferred via Binder.
URL ↓ Size validation ↓ Does it exceed the limit? ├── Yes → truncate / reject / safe alternative └── No → build ACTION_SEND
This is the preferred defense because it prevents the oversized object from reaching the IPC boundary. Browsers that already hide the Share option for excessively large URLs (Chrome, Edge) provide an example of this approach.
11.2. Framework-level mitigation
Android could provide additional protection mechanisms so that a transaction exceeding the limit does not necessarily result in an unrecoverable crash of the consuming process.
Oversized transaction
↓
Detect before / during IPC
↓
Controlled failure
↓
Fallback
↓
Application remains operational
Late detection of a size condition should not automatically become a process termination condition when a safe alternative exists.
11.3. SavedState / FragmentManager (related surface)
In related SavedState surfaces, the research additionally proposes controlled fallback against errors occurring during restoration of excessively large state.
try {
restoreStateInternal(state);
} catch (TransactionTooLargeException e) {
Log.e(TAG, "SavedState restore failed. Restarting without state.", e);
}
The goal would be to degrade to a clean state when it is safe to do so, rather than propagating the exception to cause a crash.
12. Classification
STA-003 can be classified as:
Binder Serialization Boundary Resource Exhaustion
Within the STA model:
"Uncontrolled amplification / expansion across a serialization and IPC boundary leading to resource exhaustion."
The vector also has an important characteristic: the initial data can be completely valid from a semantic point of view — a URL — and become dangerous solely due to its size and the cost of transporting it between components.
13. Scope of the claim
STA-003 does not demonstrate that Binder is inherently vulnerable or that all Android browsers are exploitable.
The research demonstrates a more specific condition:
"When an application allows excessively large data to reach an ACTION_SEND operation and subsequently cross Binder without sufficient prior validation, the transaction size limit can become a denial-of-service mechanism."
Successful exploitation depends on the specific browser implementation and whether it incorporates validation, truncation, or fallback before constructing or sending the Intent.
14. Research status
| Field | Value |
|---|---|
| Vector | STA-003 |
| First formal communication | 20 January 2026 |
| Researcher | Manuel García Peña (Lostmon) |
| Nature | Independent research |
| Platform | Android |
| Primary surface | Browser → Intent.ACTION_SEND → Binder |
| Impact | DoS |
| Interaction required | Yes |
| Privileges | None |
| Special permissions | None |
STA-003 is part of the broader Structured Text Amplification (STA) research, which studies a recurring pattern of resource exhaustion produced when input data crosses serialization, transformation, IPC, or persistence boundaries without sufficiently early resource limits.
15. Conclusion
STA-003 demonstrates how an ordinary operation — sharing a link — can become a denial-of-service condition when an oversized input crosses multiple representation layers:
URL → Intent → Parcel → Binder → transaction limit → TransactionTooLargeException → crash
The most robust mitigation is to measure and limit the size before reaching the amplification or IPC boundary, complemented by fallback mechanisms that prevent an oversize condition from unnecessarily becoming a process crash.
In the context of STA, this vector constitutes an example of how a legitimate-looking structured input can become a resource exhaustion condition when crossing a serialization boundary.
Complete whitepaper: Resilience Gaps in Android IPC, SavedState and Text Layout — v6 (August 2026)
📌 About this series
This post is part of a series documenting the 32 vectors of Structured Text Amplification (STA).
Published:
✅ STA-005 — WhatsApp
✅ STA-003 — Binder Share Intent (this post)
Whitepaper: Resilience Gaps in Android IPC, SavedState and Text Layout v5
— Lostmon · lostmon.blogspot.com
Posts
