STA-006 / 007 Translate: When translating text crashes Google Apps

Structured Text Amplification — Vectors 006 & 007

This post documents STA-006 and STA-007, two denial-of-service vectors in Google's Translate feature. An oversized text payload, when selected and sent to Translate via Intent.ACTION_TRANSLATE, can exceed the Binder transaction limit, causing a TransactionTooLargeException and a permanent crash loop in some cases.

⚠️ Severity: STA-006 and STA-007 are persistent DoS vectors in some oems implementations. A single oversized text selection can make Google App or Google Drive permanently unusable until the user clears app data. No special permissions or privileges are required.

1. Overview

STA-006 and STA-007 describe a persistent denial-of-service condition in Google's Translate feature, accessible from multiple Google apps. An attacker can craft or deliver an oversized text payload that, when selected and translated, contaminates the app's state and causes a permanent crash loop in oems.

The vector is triggered when the user selects a large text (visible or hidden) and invokes the Translate action. The app constructs an Intent.ACTION_TRANSLATE containing the selected text. During serialization of the Intent for transfer via Binder, the data size may exceed the Binder transaction limit (approximately 1 MiB). This can result in an unhandled TransactionTooLargeException, causing an immediate app crash.

Type: semi-persistent Denial of Service (DoS)
Class: Resource Exhaustion / State Persistence Boundary
CWE: CWE-400 — Uncontrolled Resource Consumption; CWE-770 — Allocation of Resources Without Limits
CVSS v3.1 estimated: 6.5 (Medium-High)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

2. Attack chain

The observed chain can be represented as:

Attacker crafts/places oversized text payload
       ↓
User selects the text (or selects all in a PDF)
       ↓
User invokes Translate action (context menu or app button)
       ↓
Google App / Google Drive constructs ACTION_TRANSLATE Intent
       ↓
Selected text stored in Intent extra (EXTRA_TEXT)
       ↓
Intent serialization (Parcel)
       ↓
Parcel size exceeds Binder limit (1 MB)
       ↓
TransactionTooLargeException
       ↓
App crashes immediately
       ↓
State may be re-persisted (in Google Drive)
       ↓
App crashes on every launch attempt (persistent crash loop)
       ↓
Recovery: clear app data or uninstall/reinstall

The fundamental characteristic of STA-006/007 is that the STA payload is delivered through a standard user action (Translate) that the app is designed to handle. The user does nothing unusual — just selects text and translates it.

3. Vector details

3.1. STA-006 — Google App (Select text → Translate)

The vector is triggered through the Google App's selection menu:

The user selects a large text (e.g., from a web page, document, or any text field).
The user taps the "Translate" action from the context menu.
Google App creates an ACTION_TRANSLATE Intent with the selected text as EXTRA_TEXT.
During serialization of the Intent, the Bundle size exceeds the Binder transaction limit.
TransactionTooLargeException is thrown and not caught.
Google App crashes immediately.

Entry point: android.app.Activity.startActivityForResult() → Instrumentation.execStartActivity() → Binder transaction → TransactionTooLargeException

3.2. STA-007 — Google Drive (PDF → Select All → Translate)

The vector is triggered through Google Drive's PDF viewer:

User opens a PDF containing invisible or oversized text (e.g., a PDF with a large hidden payload).
User selects all text (Select All) in the PDF viewer.
User taps the "Translate" action from the selection menu.
Google Drive creates an ACTION_TRANSLATE Intent with the selected text.
During serialization of the Intent, the Bundle size exceeds the Binder transaction limit.
TransactionTooLargeException is thrown and not caught.
Google Drive crashes immediately.
If the state is re-persisted, the app enters a permanent crash loop.

Entry point: PDF viewer selection menu → Intent.ACTION_TRANSLATE → Binder transaction → TransactionTooLargeException

4. Stack trace and Bundle analysis

The following stack trace and Bundle statistics were captured from a production device (Xiaomi Redmi Note 14 5G, HyperOS 3.0, Android 16) during a crash of the Google App. The crash occurred after selecting an oversized text payload, invoking Translate, and subsequently focusing the search bar, which triggered the state serialization and Binder transaction.

4.1. Exception

java.lang.RuntimeException: android.os.TransactionTooLargeException:
data parcel size 2454260 bytes
    at android.app.servertransaction.PendingTransactionActions$StopInfo.run(PendingTransactionActions.java:146)
    at android.os.Handler.handleCallback(Handler.java:1029)
    at android.os.Handler.dispatchMessage(Handler.java:107)
    at android.os.Looper.loopOnce(Looper.java:274)
    at android.os.Looper.loop(Looper.java:369)
    at android.app.ActivityThread.main(ActivityThread.java:10090)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:616)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1137)
Caused by:
android.os.TransactionTooLargeException:
data parcel size 2454260 bytes
    at android.os.BinderProxy.transactNative(Native Method)
    at android.os.BinderProxy.transact(BinderProxy.java:736)
    at android.app.IActivityClientController$Stub$Proxy.activityStopped(IActivityClientController.java:1546)
    at android.app.ActivityClient.activityStopped(ActivityClient.java:106)
    at android.app.servertransaction.PendingTransactionActions$StopInfo.run(PendingTransactionActions.java:135)

4.2. Bundle statistics

The Bundle that triggered the exception contained the following components:

Bundle stats:
    androidx.lifecycle.BundlableSavedStateRegistry.key [size=2452080]
    androidx.lifecycle.internal.SavedStateHandlesProvider [size=1127400]
    tt_activity_account_retained:6 [size=1125236]
    SearchSession:1 [size=1125012]
    androidx.lifecycle.BundlableSavedStateRegistry.key [size=1124884]
    androidx.lifecycle.internal.SavedStateHandlesProvider [size=1124752]
    androidx.lifecycle.ViewModelProvider.DefaultKey:... [size=1124452]
    BrowserSession:2 [size=963088]
    androidx.lifecycle.BundlableSavedStateRegistry.key [size=962960]
    androidx.lifecycle.internal.SavedStateHandlesProvider [size=962828]
    webx_browser [size=962464]
    webx_window [size=962416]
    web_view_url [size=962288]
    search_query_key [size=161080]
    search_query [size=161028]
    protoparsers [size=160976]
    android:support:fragments [size=1312836]
    fragment_e32da9b3... [size=1312412]
    arguments [size=161152]
    TIKTOK_FRAGMENT_ARGUMENT [size=161008]
    childFragmentManager [size=1312836]
    android-support-nav:controller:backStack [size=326252]
    registryState [size=168492]
    SEARCH_QUERY_STATE [size=160976]
    ... (additional nested fragment states)

4.3. Key metrics

Component	Size
Input (search_query)	~161,028 bytes
childFragmentManager	1,312,836 bytes
SavedStateHandlesProvider	1,127,400 bytes
SearchSession / BrowserSession	~1,125,000 bytes each
Total Bundle size	2,454,260 bytes
Binder transaction limit	1,048,576 bytes
Excess	+1,405,684 bytes (+134%)
Amplification factor	×15.2

Key observation: The input payload (~161 KB) is amplified to a total Bundle size of 2.45 MB through the serialization of nested Fragment states, SavedState handles, and session data. The amplification factor of ×15.2 is consistent with the amplification patterns documented in other Class A vectors (STA-005, ×20.6; STA-012, ×20.6).

5. Affected components

Primary

android.content.Intent — ACTION_TRANSLATE intent extra serialization
android.os.Bundle — serialization container
android.os.Parcel — Binder serialization
android.app.ActivityThread — lifecycle handling
androidx.fragment.app.FragmentManager — fragment state serialization
androidx.lifecycle.SavedStateHandlesProvider — SavedState management

Secondary

android.app.ActivityManagerProxy — Binder transaction
Google App (com.google.android.googlequicksearchbox) — Translate feature
Google Drive (com.google.android.apps.docs) — PDF viewer + Translate feature

6. Persistence

Persistence: YES (STA-007), Conditional (STA-006)

STA-006 (Google App): The app may crash immediately, but the state is not always re-persisted. Recovery typically involves reopening the app.
STA-007 (Google Drive): The PDF viewer state is saved, and the oversized payload may be re-persisted, causing a crash on every launch.

Recovery typically requires:

Clearing the app data (via adb pm clear com.google.android.googlequicksearchbox or adb pm clear com.google.android.apps.docs)
Uninstalling and reinstalling the app (loses all data)

7. Why this matters

STA-006 and STA-007 are not just crashes. They are semi-persistent denial-of-service vectors with significant implications:

For individual users: They lose access to the app until they clear data, losing all settings and potentially documents.
For Google: A single malicious document can make Google Drive unusable for any user who opens it and attempts to translate.
For the platform: This is a single point of failure in the Intent serialization and Binder transaction mechanism.

The vector is particularly concerning because:

The payload can be delivered through a standard PDF document that the app is designed to handle.
No special permissions are required.
The user does nothing unusual — just selects text and translates it.
The impact is persistent in some OEMS and requires clearing data to recover.

8. Relationship to other STA vectors

Vector	Relationship
STA-003	Same mechanism (Share Intent → Binder → TransactionTooLargeException)
STA-005	Same mechanism (text input → SavedState → Bundle → Binder → crash loop). WhatsApp has a similar amplification factor (×20.6).
STA-012	Same mechanism (deep link → Fragment args → SavedState → Binder → crash loop)
STA-028	UTF-16 encoding amplification is a contributing factor to the measured amplification.

9. Chromium commit evidence

Chromium commit 84b615a0 (5 May 2026) added the Translate action to the Android PDF viewer's selection menu, confirming that this surface is considered relevant and that Google engineers have been working on it. The commit introduced:

84b615a07fc14988b46f0e362502ab4075216793
Author: Ryan Thomas
Date: 5 May 2026
Component: Android PDF viewer selection menu
Changes: Added Share, Web Search, Translate actions to selection menu

This demonstrates that the surface identified by STA-006/007 is being actively developed and modified, further validating the architectural relevance of the findings.

10. Recommended mitigation

10.1. Application-level (Google App / Google Drive)

Validate the size of selected text before constructing the ACTION_TRANSLATE Intent.
Truncate text to a safe limit (e.g., 8 KB) before placing it in EXTRA_TEXT.
Catch TransactionTooLargeException and fall back to a clean state.

// Recommended approach for Translate action
String selectedText = getSelectedText();
if (selectedText != null && selectedText.length() > MAX_SAFE_LENGTH) {
    selectedText = selectedText.substring(0, MAX_SAFE_LENGTH);
    Log.w(TAG, "Selected text truncated to safe length");
}
Intent translateIntent = new Intent(Intent.ACTION_TRANSLATE);
translateIntent.putExtra(Intent.EXTRA_TEXT, selectedText);
try {
    startActivity(translateIntent);
} catch (TransactionTooLargeException e) {
    Log.e(TAG, "Translate Intent too large", e);
    // Fallback: show error dialog or use alternative translation method
}

10.2. Framework-level (Android)

Intent serialization should include a size estimation before Binder transaction.
SystemUI should catch TransactionTooLargeException and handle it gracefully.
FragmentManager should limit the size of saved state before serialization.

11. Research status

Field	Value
Vectors	STA-006, STA-007
First formal communication	20 January 2026
Researcher	Manuel García Peña (Lostmon)
Nature	Independent research
Platform	Android
Impact	Persistent DoS
Interaction required	Yes (one click / selection)
Privileges	None
Tier	A (Confirmed — full stack trace + exception)

STA-006/007 are part of the broader Structured Text Amplification (STA) research, which studies a recurring pattern of resource exhaustion produced when input data crosses serialization, transformation, IPC, or persistence boundaries without sufficiently early resource limits.

12. Conclusion

STA-006 and STA-007 demonstrate how a standard Translate action can become a persistent denial-of-service vector when the app fails to validate the size of selected text before constructing an Intent.

The amplification mechanism is consistent with other Class A vectors, confirming that the problem is architectural rather than specific to a single app:

Selected text (~161 KB)
 → Intent (ACTION_TRANSLATE)
 → FragmentManager serialization
 → SavedStateHandlesProvider
 → Bundle (2.45 MB)
 → Parcel
 → Binder
 → TransactionTooLargeException
 → Persistent crash loop

The most robust mitigation is to validate input size before constructing the Intent, complemented by fallback mechanisms that prevent an oversize condition from becoming a persistent crash loop.

Complete whitepaper: Resilience Gaps in Android IPC, SavedState and Text Layout — v6 (August 2026)

📌 About this series
This post is part of a series documenting the 32 vectors of Structured Text Amplification (STA).

Published:
✅ STA-017 — Cross-Engine ANR
✅ STA-015-DL — Google Drive → SystemUI
✅ STA-005 — WhatsApp
✅ STA-003 — Binder Share Intent
✅ STA-006/007 — Translate (this post)

Coming next:
⬜ STA-012 — Threads
⬜ STA-019 — Firefox
⬜ STA-022 — DuckDuckGo

Whitepaper: Resilience Gaps in Android IPC, SavedState and Text Layout — v6

— Lostmon · lostmon.blogspot.com

Lostmon Blogger