STA-003 When sharing an oversized link breaks the browser (Binder Share Intent)

STA-003 Binder Share Intent TransactionTooLargeException

Structured Text Amplification — Vector 003

This post documents STA-003, a denial-of-service vector in Android browsers where an oversized URL shared via the context menu triggers a TransactionTooLargeException during Binder serialization of the ACTION_SEND Intent, causing an immediate browser crash.

⚠️ Severity: STA-003 is an interactive DoS vector. A single long-press on a crafted link followed by "Share" can crash the browser immediately. No special permissions or privileges are required.

---

1. Summary

STA-003 describes a denial-of-service condition in Android web browsers when an excessively large URL is shared via the context menu of a link.

The vector is triggered when the user performs a long-press on a link and selects "Share". The browser constructs an ACTION_SEND Intent containing the URL as EXTRA_TEXT. During serialization of the Intent for transfer via Binder, the data size may exceed the Binder transaction limit (approximately 1 MiB). This can result in an unhandled TransactionTooLargeException, causing an immediate browser process termination.

Type: Denial of Service (DoS)
Class: Resource Exhaustion / IPC Serialization Boundary
CWE: CWE-20 — Improper Input Validation; CWE-400 — Uncontrolled Resource Consumption
CVSS v4.0 estimated: 6.5 (Medium)

---

2. Attack chain

The observed chain can be represented as:

Malicious web page
       ↓
Excessively large URL
       ↓
Long-press on the link
       ↓
Context menu
       ↓
"Share"
       ↓
Intent ACTION_SEND
       ↓
EXTRA_TEXT = URL
       ↓
Intent serialization
       ↓
Binder IPC
       ↓
Parcel > transaction limit
       ↓
TransactionTooLargeException
       ↓
Browser crash
       ↓
Denial of Service

The fundamental characteristic of STA-003 is that a legitimate-looking input — a URL — acquires a disproportionate cost when crossing a serialization/IPC boundary.

---

3. Difference from STA-001

STA-003 must be kept separate from STA-001.

Vector	Mechanism	Failure
STA-001	Context menu processing	Prolonged processing / freeze before crash
STA-003	ACTION_SEND Intent → Binder serialization	Immediate crash during Intent serialization

STA-001 is associated with prolonged processing during context menu construction, with a noticeable freeze before the crash.

STA-003 fails during the Share operation itself:

Long URL
       ↓
ACTION_SEND
       ↓
Intent serialization
       ↓
Binder
       ↓
TransactionTooLargeException
       ↓
Immediate crash

---

4. Required conditions

The attack requires:

• An Android browser that exposes the Share operation for the affected link.
• A page containing a link with a sufficiently large URL to exceed the effective Binder transaction limit.
• The victim performs a long-press on the link.
• The victim selects "Share".

Not required:

• Special Android permissions
• Local access to the device
• Application privileges
• Prior code execution on the device

The URL can be distributed via any channel capable of delivering a link, including web pages, messaging, email, social networks, QR codes, or other URL distribution mechanisms.

---

5. Browser-specific observations

A relevant observation during the investigation is that the availability of the vector depends on how each browser handles excessively large URLs.

Browser	Behaviour	Mitigation level
Google Chrome	Does not present Share option for extremely large URLs	Application-level
Microsoft Edge	Equivalent mitigation behaviour	Application-level
Opera Browser	Share operation available → TransactionTooLargeException → crash	No mitigation

This difference is important because it demonstrates two levels of mitigation:

Application-level mitigation:
    Avoid generating/sending an excessively large Intent

Framework-level:
    Accept an oversized operation
    ↓
    TransactionTooLargeException
    ↓
    Safe fallback / degradation

The existence of application-level mitigations does not eliminate the underlying condition in the IPC mechanism.

---

6. Stack trace and evidence

The following stack trace was captured during a Share operation with an oversized URL. The excerpt is abbreviated; irrelevant frames and build-specific details have been omitted.

Share Intent crash

java.lang.RuntimeException: android.os.TransactionTooLargeException:
data parcel size 1662976 bytes
at android.app.ActivityClient.activityStopped(ActivityClient.java:101)
at android.app.servertransaction.PendingTransactionActions$StopInfo.run()
at android.app.servertransaction.PendingTransactionActions$StopInfo.run(...)
at android.os.Handler.dispatchMessage(Handler.java)
at android.os.Looper.loop(Looper.java)
at android.app.ActivityThread.main(ActivityThread.java)

Key metric: Parcel size 1,662,976 bytes — exceeds the Binder transaction limit (1,048,576 bytes) by approximately 58%. The crash is immediate, with no observable delay.

Vulnerable code pattern

The following pattern is present in many browsers and apps that implement sharing functionality:

// Browser code (simplified)
Intent shareIntent = new Intent(Intent.ACTION_SEND);
shareIntent.setType("text/plain");
shareIntent.putExtra(Intent.EXTRA_TEXT, url); // ← No size check!
startActivity(Intent.createChooser(shareIntent, "Share via"));

The Android framework provides no guardrails for Intent.putExtra() size, and no automatic truncation or validation is performed before the Intent is serialized for Binder transmission.

---

7. Impact

The observed impact is a denial of service of the browser:

• Immediate browser crash during the Share operation
• Loss of browsing session
• Interruption of user activity
• Potential repetition of the crash if the operation is re-executed

Unlike STA-001 (which may show a 10-17 second freeze before crash), STA-003 crashes immediately during Intent serialization.

Any application implementing share functionality is potentially vulnerable:

• Web browsers (all vendors)
• Email clients
• Social media apps
• Messaging apps
• Document viewers
• File managers
• Any app with a "Share" button for text/URLs

Estimated affected apps: 10,000+ on Play Store

---

8. Relationship to Structured Text Amplification

STA-003 belongs to the class of vectors where a legitimate-looking data item crosses a transformation or serialization boundary without a sufficiently early limit.

The pattern can be expressed as:

Small / legitimate input
        ↓
Transformation / serialization
        ↓
Structured representation
        ↓
IPC boundary
        ↓
Resource limit exceeded
        ↓
Failure / DoS

In STA-003:

URL
 ↓
String / EXTRA_TEXT
 ↓
Intent
 ↓
Parcel
 ↓
Binder
 ↓
TransactionTooLargeException
 ↓
Browser crash

The vector therefore does not depend solely on the logical size of the URL. The relevant cost is the size of the representation that must ultimately cross the IPC boundary.

---

9. Proof of Concept

The PoC consists of an HTML page containing a link with an extremely large URL:

<a href="https://example.com/[STA Pattern]">
    Test link
</a>

During the investigation, character patterns were used to produce an especially large representation after encoding/serialization transformations. The full payload is not included in this public documentation to reduce the potential for abuse.

Conceptual reproduction:

1. Open an affected Android browser (e.g., Opera).
2. Access a page containing the prepared link.
3. Long-press the link.
4. Select "Share".
5. Observe the immediate browser crash.
6. Logs may show TransactionTooLargeException with a parcel size exceeding 1 MB.

---

10. Evidence and background

The research relates STA-003 to the following background:

• Chromium Issue 40879254 (2022): Issue related to sharing an excessively large URL for Binder.
• Mozilla Bugzilla #1802594: Incidents related to TransactionTooLargeException / DeadSystemException in Firefox.
• Chromium: Changes intended to truncate visible URLs and reduce the size of certain data before subsequent operations.
• Android TransactionTooLargeException: Official documentation of the failure mechanism associated with excessively large Binder transactions.
• Android Intent.ACTION_SEND: Surface used to transfer content that subsequently crosses IPC.

These references constitute independent background that helps establish that the attack surface is not limited to a specific browser implementation.

A relevant observation during the investigationis that Chrome and Edge hide the Share option for extremely large URLs, while Opera does not. This suggests that Chrome's behaviour is a deliberate application-level mitigation rather than a framework-level protection. The difference is important: it demonstrates that application-level mitigations can prevent the crash, but they do not address the underlying framework condition. A malicious payload delivered through an app that lacks such a mitigation (like Opera) still triggers the TransactionTooLargeException and crash. This aligns with Google's documented position that TransactionTooLargeException is a framework constraint, not a security vulnerability. However, the availability of application-level mitigations does not eliminate the underlying risk for apps that do not implement them.

---

11. Proposed mitigation

11.1. Application-level mitigation

The browser should check the URL size before constructing the Intent that will be transferred via Binder.

URL
 ↓
Size validation
 ↓
Does it exceed the limit?
 ├── Yes → truncate / reject / safe alternative
 └── No → build ACTION_SEND

This is the preferred defense because it prevents the oversized object from reaching the IPC boundary. Browsers that already hide the Share option for excessively large URLs (Chrome, Edge) provide an example of this approach.

11.2. Framework-level mitigation

Android could provide additional protection mechanisms so that a transaction exceeding the limit does not necessarily result in an unrecoverable crash of the consuming process.

Oversized transaction
        ↓
Detect before / during IPC
        ↓
Controlled failure
        ↓
Fallback
        ↓
Application remains operational

Late detection of a size condition should not automatically become a process termination condition when a safe alternative exists.

11.3. SavedState / FragmentManager (related surface)

In related SavedState surfaces, the research additionally proposes controlled fallback against errors occurring during restoration of excessively large state.

try {
    restoreStateInternal(state);
} catch (TransactionTooLargeException e) {
    Log.e(TAG, "SavedState restore failed. Restarting without state.", e);
}

The goal would be to degrade to a clean state when it is safe to do so, rather than propagating the exception to cause a crash.

---

12. Classification

STA-003 can be classified as:

Binder Serialization Boundary Resource Exhaustion

Within the STA model:

"Uncontrolled amplification / expansion across a serialization and IPC boundary leading to resource exhaustion."

The vector also has an important characteristic: the initial data can be completely valid from a semantic point of view — a URL — and become dangerous solely due to its size and the cost of transporting it between components.

---

13. Scope of the claim

STA-003 does not demonstrate that Binder is inherently vulnerable or that all Android browsers are exploitable.

The research demonstrates a more specific condition:

"When an application allows excessively large data to reach an ACTION_SEND operation and subsequently cross Binder without sufficient prior validation, the transaction size limit can become a denial-of-service mechanism."

Successful exploitation depends on the specific browser implementation and whether it incorporates validation, truncation, or fallback before constructing or sending the Intent.

---

14. Research status

Field	Value
Vector	STA-003
First formal communication	20 January 2026
Researcher	Manuel García Peña (Lostmon)
Nature	Independent research
Platform	Android
Primary surface	Browser → Intent.ACTION_SEND → Binder
Impact	DoS
Interaction required	Yes
Privileges	None
Special permissions	None

STA-003 is part of the broader Structured Text Amplification (STA) research, which studies a recurring pattern of resource exhaustion produced when input data crosses serialization, transformation, IPC, or persistence boundaries without sufficiently early resource limits.

---

15. Conclusion

STA-003 demonstrates how an ordinary operation — sharing a link — can become a denial-of-service condition when an oversized input crosses multiple representation layers:

URL
 → Intent
 → Parcel
 → Binder
 → transaction limit
 → TransactionTooLargeException
 → crash

The most robust mitigation is to measure and limit the size before reaching the amplification or IPC boundary, complemented by fallback mechanisms that prevent an oversize condition from unnecessarily becoming a process crash.

In the context of STA, this vector constitutes an example of how a legitimate-looking structured input can become a resource exhaustion condition when crossing a serialization boundary.

---

Complete whitepaper: Resilience Gaps in Android IPC, SavedState and Text Layout — v6 (August 2026)

---

📌 About this series
This post is part of a series documenting the 32 vectors of Structured Text Amplification (STA).

Published:
✅ STA-005 — WhatsApp
✅ STA-003 — Binder Share Intent (this post)

Whitepaper: Resilience Gaps in Android IPC, SavedState and Text Layout v5

---

— Lostmon · lostmon.blogspot.com