Three Vectors, One Root Cause
Chrome 152.0.7977.82 and Edge 152.0.4191.53 remain vulnerable to three distinct Structured Text Amplification (STA) vectors on Android 16. A full forensic bugreport captured on September 6, 2026 confirms the failure chain from oversized Bundle to Binder transaction failure to process termination. The September 2026 Android Security Bulletin contains no patches for the affected paths.
1. Executive Summary
Three STA vectors are confirmed reproducible in the two dominant Chromium-based browsers on Android:
| Vector | Trigger | Chrome 152 | Edge 2026 | Impact |
|---|---|---|---|---|
| STA-003 | Click Share on a crafted link | CRASH | CRASH | Process termination |
| STA-017 | Long-press on a crafted link | ANR | ANR | UI freeze + force finish |
| STA-020 | Focus address bar after crafted URL in history | ANR | ANR | UI freeze + force finish |
Architectural root cause: The demonstrated failure paths converge on Android platform components — libminikin.so for text processing and the IActivityTaskManager Binder boundary for oversized transactions. The evidence indicates that browser-level mitigations cannot fully address these platform-level execution paths.
2. Test Environment
| Parameter | Value |
|---|---|
| Device | Xiaomi Redmi Note 14 5G |
| OS | Android 16, HyperOS 3.0.301.0 (build BP2A.250605.031.A3) |
| Chrome | 152.0.7977.82 (stable) |
| Edge | 152.0.4191.53 (stable) |
| Bugreport | bugreport-2026-09-06-200012.zip |
| libminikin.so BuildId | 4fabe53671b5ead88314c00a1fd6d67d |
3. STA-003 — Share Intent Crash
3.1 Trigger
The user clicks Share on a crafted link with an oversized URL. The browser constructs a share Intent carrying the oversized crafted content, which is propagated through the Android activity-start path and ultimately reaches the Binder transaction boundary.
Scope note: In the controlled reproduction, the variable extra content was identified as the crafted STA pattern. The corresponding extra key is redacted in the captured bugreport, so this article does not claim to read the exact extra key from the forensic dump itself.
3.2 Forensic evidence from the bugreport
The Android BaseBundleMonitorImpl (Xiaomi HyperOS) logged the following immediately before the failure:
19:56:56.867 BaseBundleMonitorImpl:
Large Bundle: length=1531092, bundle=8814309
19:56:56.867 BaseBundleMonitorImpl:
Large Bundle: length=1532640, bundle=36c790e
Binder then recorded the outgoing transaction and its failure:
Binder transaction failure id: 12562575 error: -28 (No space left on device) Large outgoing transaction of 1533260 bytes interface descriptor: android.app.IActivityTaskManager code 1 JavaBinder: FAILED BINDER TRANSACTION parcel size = 1533260
The Java framework then threw the corresponding exception:
android.os.TransactionTooLargeException: data parcel size 1533260 bytes at android.os.BinderProxy.transactNative(Native Method) at android.os.BinderProxy.transact(BinderProxy.java:642) at android.app.IActivityTaskManager$Stub$Proxy.startActivity(...) at android.app.Instrumentation.execStartActivity(...) at android.app.Activity.startActivityForResult(...) at org.chromium.ui.base.WindowAndroid.R(...) ...
Finally, the system terminated the browser process:
wm_finish_activity: com.microsoft.emmx/org.chromium.chrome.browser.ChromeTabbedActivity, force-crash am_proc_died: com.microsoft.emmx
3.3 Chrome confirmation
The same sequence reproduces in Chrome 152 with nearly identical numbers:
TransactionTooLargeException: data parcel size 1533240 bytes wm_finish_activity: com.android.chrome/org.chromium.chrome.browser.ChromeTabbedActivity, force-crash am_proc_died: com.android.chrome
Critical observation: Edge failed at 1,533,260 bytes. Chrome failed at 1,533,240 bytes. The difference is 20 bytes. Both browsers reach the same Chromium Activity-start path and both fail at the same Android Binder boundary.
4. STA-017 — Long-Press ANR
4.1 Trigger
The user long-presses a link. The context menu rendering path attempts to measure the anchor text and URL through TextView.onMeasure() → StaticLayout → libhwui → libminikin.so.
4.2 Stack trace (Chrome 152)
"main" prio=5 tid=1 Native ← UI THREAD BLOCKED
| state=R
native: minikin::getPrevWordBreakForCache libminikin.so
native: minikin::StyleRun::getLineMetrics libminikin.so
native: minikin::MeasuredText::getLineMetrics libminikin.so
native: minikin::LineBreakOptimizer::computeBreaks libminikin.so
← expensive text-processing path
native: minikin::breakLineOptimal libminikin.so
native: android::nComputeLineBreaks libhwui.so
at android.text.StaticLayout.generate(StaticLayout.java:969)
at android.widget.TextView.onMeasure(TextView.java:11486)
at org.chromium.chrome.browser.contextmenu.ContextMenuListView.onMeasure
at android.view.ViewRootImpl.performTraversals
4.3 System response
ANR in Window ... ChromeTabbedActivity is not responding. Waited 5000ms for MotionEvent(action=DOWN) → Force finishing activity ChromeTabbedActivity → Killing process
4.4 Edge confirmation
Edge reproduces the identical path. The ANR subject is:
Input dispatching timed out (com.microsoft.emmx/...ChromeTabbedActivity is not responding. Waited 5000ms for MotionEvent(action=DOWN))
5. STA-020 — Address-Bar Focus ANR
5.1 Trigger
A crafted URL is stored in browser history (e.g. after a previous navigation). The user focuses the address bar. The omnibox suggestion list is rendered through OmniboxSuggestionsContainer.onMeasure() → RecyclerView → TextView.onMeasure() → StaticLayout → libminikin.so.
5.2 Stack trace (Edge 2026-09-06)
"main" prio=5 tid=1 Native | state=R at android.text.StaticLayout.generate at android.text.StaticLayout.at android.widget.TextView.onMeasure at androidx.appcompat.widget.AppCompatTextView.onMeasure at android.widget.LinearLayout.measureVertical at org.chromium.chrome.browser.omnibox.suggestions.base.BaseSuggestionView.onMeasure at androidx.recyclerview.widget.RecyclerView.onMeasure at android.view.ViewRootImpl.performTraversals at android.view.Choreographer.doFrame
5.3 System response
ANR in Window ... ChromeTabbedActivity → Force finishing activity → Killing process
Note: The Edge ANR was captured at 19:40:33 on 2026-09-06 during normal device use — not a synthetic test. It is a spontaneous production capture, which strengthens the reproducibility of the vector.
6. Why Chromium Patches Do Not Fix This
During 2026, Chromium introduced several mitigations for large IPC payloads and oversized text. None of them address the vectors documented above.
| Patch | Surface | STA-003 | STA-017 | STA-020 |
|---|---|---|---|---|
| SelectionUtils / 100 KB | PDF text selection | No | No | No |
| LargePayloadSupport (FD) | Credential Manager | No | No | No |
| SharedMemory (Union) | Native Messaging | No | No | No |
| Oversized Clipboard (ContentProvider) | Clipboard | No | No | No |
| PdfView anchors | PdfView SavedState | No | No | No |
| TLE telemetry | Native Messaging | No | No | No |
The vulnerable paths are in Android platform components. They are libminikin.so (text processing) and the IActivityTaskManager Binder boundary (oversized transactions). Chromium cannot patch these paths.
7. September 2026 Android Security Bulletin — No Patches for STA
The September 2026 Android Security Bulletin was published on 8 September 2026. A complete search of the bulletin reveals zero references to the surfaces documented in this paper:
| Keyword | Results in Bulletin |
|---|---|
libminikin | 0 |
Binder | 0 |
SavedState | 0 |
TransactionTooLarge | 0 |
StaticLayout, TextView, LineBreakOptimizer | 0 |
The bulletin contains dozens of CVEs across Framework, System, and Kernel — including critical RCEs — but none of them address the STA root causes.
8. The Failure Chain (Recap)
STA payload (crafted URL / oversized structured text)
↓
User action (Share / long-press / focus address bar)
↓
Chromium builds a share Intent or triggers a TextView measurement call
↓
Android platform components:
· StaticLayout → libhwui → libminikin.so (STA-017 / STA-020)
· IActivityTaskManager.startActivity() → Binder (STA-003)
↓
Main thread blocked >5 s OR Binder transaction failure
↓
ANR (STA-017 / STA-020)
or
TransactionTooLargeException → Force finishing activity → Killing (STA-003)
9. Why This Matters
Three points are worth emphasizing:
- Two independent browsers. Chrome 152 and Edge 2026 both reproduce all three vectors. This is not a Chrome-specific defect.
- Two independent mechanisms. STA-003 fails at the Binder boundary; STA-017 and STA-020 fail inside libminikin. Both mechanisms share the same architectural root: no early length gate before an expensive or bounded operation.
- No upstream mitigation. Neither the Chromium 2026 patches nor the September 2026 Android Security Bulletin address the affected paths.
10. Recommendations
10.1 Framework (AOSP / Android)
- Introduce a global length gate in
libminikin::LineBreakOptimizer::computeBreaks()and in the measurement/shaping paths (Layout::measureText,LayoutPiece) before entering expensive operations. - Validate the size of an
Intent/Bundlebefore callingIActivityTaskManager.startActivity(), and reject or truncate oversized payloads instead of letting the Binder transaction fail withTransactionTooLargeException. - Instrument the affected paths with telemetry so that oversized payloads are detected before they cause user-visible failures.
10.2 Application-level (defensive)
- Truncate URL / share text to a safe maximum (e.g. 50,000 characters) before passing it to the system share sheet.
- Truncate suggestion / history text before measuring it in an omnibox or context menu.
These application-level measures reduce the attack surface but do not fix the root cause.
11. Conclusion
Chrome 152.0.7977.82 and Edge 152.0.4191.53 are vulnerable to three STA vectors on Android 16:
- STA-003 — Share Intent crash (process termination).
- STA-017 — Long-press ANR (main-thread block in libminikin).
- STA-020 — Address-bar focus ANR (main-thread block in libminikin).
Forensic evidence from a production bugreport (2026-09-06) confirms the full failure chain from oversized Bundle to Binder transaction failure to process termination. The September 2026 Android Security Bulletin contains no patches for the affected paths.
The evidence indicates that the issue is not confined to a specific browser implementation. Chromium-only mitigations cannot fully address the demonstrated Android text-processing and Binder execution paths. A platform-level fix in AOSP appears necessary.
Posts
