Three Vectors, One Root Cause

Chrome 152.0.7977.82 and Edge 152.0.4191.53 remain vulnerable to three distinct Structured Text Amplification (STA) vectors on Android 16. A full forensic bugreport captured on September 6, 2026 confirms the failure chain from oversized Bundle to Binder transaction failure to process termination. The September 2026 Android Security Bulletin contains no patches for the affected paths.

1. Executive Summary

Three STA vectors are confirmed reproducible in the two dominant Chromium-based browsers on Android:

Vector	Trigger	Chrome 152	Edge 2026	Impact
STA-003	Click Share on a crafted link	CRASH	CRASH	Process termination
STA-017	Long-press on a crafted link	ANR	ANR	UI freeze + force finish
STA-020	Focus address bar after crafted URL in history	ANR	ANR	UI freeze + force finish

Architectural root cause: The demonstrated failure paths converge on Android platform components — libminikin.so for text processing and the IActivityTaskManager Binder boundary for oversized transactions. The evidence indicates that browser-level mitigations cannot fully address these platform-level execution paths.

2. Test Environment

Parameter	Value
Device	Xiaomi Redmi Note 14 5G
OS	Android 16, HyperOS 3.0.301.0 (build BP2A.250605.031.A3)
Chrome	152.0.7977.82 (stable)
Edge	152.0.4191.53 (stable)
Bugreport	bugreport-2026-09-06-200012.zip
libminikin.so BuildId	`4fabe53671b5ead88314c00a1fd6d67d`

3. STA-003 — Share Intent Crash

3.1 Trigger

The user clicks Share on a crafted link with an oversized URL. The browser constructs a share Intent carrying the oversized crafted content, which is propagated through the Android activity-start path and ultimately reaches the Binder transaction boundary.

Scope note: In the controlled reproduction, the variable extra content was identified as the crafted STA pattern. The corresponding extra key is redacted in the captured bugreport, so this article does not claim to read the exact extra key from the forensic dump itself.

3.2 Forensic evidence from the bugreport

The Android BaseBundleMonitorImpl (Xiaomi HyperOS) logged the following immediately before the failure:

19:56:56.867  BaseBundleMonitorImpl:
               Large Bundle: length=1531092, bundle=8814309
19:56:56.867  BaseBundleMonitorImpl:
               Large Bundle: length=1532640, bundle=36c790e

Binder then recorded the outgoing transaction and its failure:

Binder transaction failure
id: 12562575
error: -28 (No space left on device)

Large outgoing transaction of 1533260 bytes
interface descriptor: android.app.IActivityTaskManager
code 1

JavaBinder: FAILED BINDER TRANSACTION
parcel size = 1533260

The Java framework then threw the corresponding exception:

android.os.TransactionTooLargeException:
data parcel size 1533260 bytes

  at android.os.BinderProxy.transactNative(Native Method)
  at android.os.BinderProxy.transact(BinderProxy.java:642)
  at android.app.IActivityTaskManager$Stub$Proxy.startActivity(...)
  at android.app.Instrumentation.execStartActivity(...)
  at android.app.Activity.startActivityForResult(...)
  at org.chromium.ui.base.WindowAndroid.R(...)
  ...

Finally, the system terminated the browser process:

wm_finish_activity:
com.microsoft.emmx/org.chromium.chrome.browser.ChromeTabbedActivity, force-crash

am_proc_died:
com.microsoft.emmx

3.3 Chrome confirmation

The same sequence reproduces in Chrome 152 with nearly identical numbers:

TransactionTooLargeException:
data parcel size 1533240 bytes

wm_finish_activity:
com.android.chrome/org.chromium.chrome.browser.ChromeTabbedActivity, force-crash

am_proc_died:
com.android.chrome

Critical observation: Edge failed at 1,533,260 bytes. Chrome failed at 1,533,240 bytes. The difference is 20 bytes. Both browsers reach the same Chromium Activity-start path and both fail at the same Android Binder boundary.

4. STA-017 — Long-Press ANR

4.1 Trigger

The user long-presses a link. The context menu rendering path attempts to measure the anchor text and URL through TextView.onMeasure() → StaticLayout → libhwui → libminikin.so.

4.2 Stack trace (Chrome 152)

"main" prio=5 tid=1 Native   ← UI THREAD BLOCKED
  | state=R

native: minikin::getPrevWordBreakForCache          libminikin.so
native: minikin::StyleRun::getLineMetrics          libminikin.so
native: minikin::MeasuredText::getLineMetrics      libminikin.so
native: minikin::LineBreakOptimizer::computeBreaks libminikin.so
                                                   ← expensive text-processing path
native: minikin::breakLineOptimal                  libminikin.so
native: android::nComputeLineBreaks                libhwui.so

  at android.text.StaticLayout.generate(StaticLayout.java:969)
  at android.widget.TextView.onMeasure(TextView.java:11486)
  at org.chromium.chrome.browser.contextmenu.ContextMenuListView.onMeasure
  at android.view.ViewRootImpl.performTraversals

4.3 System response

ANR in Window ... ChromeTabbedActivity is not responding.
Waited 5000ms for MotionEvent(action=DOWN)

→ Force finishing activity ChromeTabbedActivity
→ Killing process

4.4 Edge confirmation

Edge reproduces the identical path. The ANR subject is:

Input dispatching timed out
(com.microsoft.emmx/...ChromeTabbedActivity is not responding.
 Waited 5000ms for MotionEvent(action=DOWN))

5. STA-020 — Address-Bar Focus ANR

5.1 Trigger

A crafted URL is stored in browser history (e.g. after a previous navigation). The user focuses the address bar. The omnibox suggestion list is rendered through OmniboxSuggestionsContainer.onMeasure() → RecyclerView → TextView.onMeasure() → StaticLayout → libminikin.so.

5.2 Stack trace (Edge 2026-09-06)

"main" prio=5 tid=1 Native
  | state=R

  at android.text.StaticLayout.generate
  at android.text.StaticLayout.
  at android.widget.TextView.onMeasure
  at androidx.appcompat.widget.AppCompatTextView.onMeasure
  at android.widget.LinearLayout.measureVertical
  at org.chromium.chrome.browser.omnibox.suggestions.base.BaseSuggestionView.onMeasure
  at androidx.recyclerview.widget.RecyclerView.onMeasure
  at android.view.ViewRootImpl.performTraversals
  at android.view.Choreographer.doFrame

5.3 System response

ANR in Window ... ChromeTabbedActivity
→ Force finishing activity
→ Killing process

Note: The Edge ANR was captured at 19:40:33 on 2026-09-06 during normal device use — not a synthetic test. It is a spontaneous production capture, which strengthens the reproducibility of the vector.

6. Why Chromium Patches Do Not Fix This

During 2026, Chromium introduced several mitigations for large IPC payloads and oversized text. None of them address the vectors documented above.

Patch	Surface	STA-003	STA-017	STA-020
SelectionUtils / 100 KB	PDF text selection	No	No	No
LargePayloadSupport (FD)	Credential Manager	No	No	No
SharedMemory (Union)	Native Messaging	No	No	No
Oversized Clipboard (ContentProvider)	Clipboard	No	No	No
PdfView anchors	PdfView SavedState	No	No	No
TLE telemetry	Native Messaging	No	No	No

The vulnerable paths are in Android platform components. They are libminikin.so (text processing) and the IActivityTaskManager Binder boundary (oversized transactions). Chromium cannot patch these paths.

7. September 2026 Android Security Bulletin — No Patches for STA

The September 2026 Android Security Bulletin was published on 8 September 2026. A complete search of the bulletin reveals zero references to the surfaces documented in this paper:

Keyword	Results in Bulletin
`libminikin`	0
`Binder`	0
`SavedState`	0
`TransactionTooLarge`	0
`StaticLayout`, `TextView`, `LineBreakOptimizer`	0

The bulletin contains dozens of CVEs across Framework, System, and Kernel — including critical RCEs — but none of them address the STA root causes.

8. The Failure Chain (Recap)

STA payload (crafted URL / oversized structured text)
        ↓
User action (Share / long-press / focus address bar)
        ↓
Chromium builds a share Intent or triggers a TextView measurement call
        ↓
Android platform components:
  · StaticLayout → libhwui → libminikin.so   (STA-017 / STA-020)
  · IActivityTaskManager.startActivity() → Binder   (STA-003)
        ↓
Main thread blocked >5 s OR Binder transaction failure
        ↓
ANR  (STA-017 / STA-020)
or
TransactionTooLargeException → Force finishing activity → Killing  (STA-003)

9. Why This Matters

Three points are worth emphasizing:

Two independent browsers. Chrome 152 and Edge 2026 both reproduce all three vectors. This is not a Chrome-specific defect.
Two independent mechanisms. STA-003 fails at the Binder boundary; STA-017 and STA-020 fail inside libminikin. Both mechanisms share the same architectural root: no early length gate before an expensive or bounded operation.
No upstream mitigation. Neither the Chromium 2026 patches nor the September 2026 Android Security Bulletin address the affected paths.

10. Recommendations

10.1 Framework (AOSP / Android)

Introduce a global length gate in libminikin::LineBreakOptimizer::computeBreaks() and in the measurement/shaping paths (Layout::measureText, LayoutPiece) before entering expensive operations.
Validate the size of an Intent / Bundle before calling IActivityTaskManager.startActivity(), and reject or truncate oversized payloads instead of letting the Binder transaction fail with TransactionTooLargeException.
Instrument the affected paths with telemetry so that oversized payloads are detected before they cause user-visible failures.

10.2 Application-level (defensive)

Truncate URL / share text to a safe maximum (e.g. 50,000 characters) before passing it to the system share sheet.
Truncate suggestion / history text before measuring it in an omnibox or context menu.

These application-level measures reduce the attack surface but do not fix the root cause.

11. Conclusion

Chrome 152.0.7977.82 and Edge 152.0.4191.53 are vulnerable to three STA vectors on Android 16:

STA-003 — Share Intent crash (process termination).
STA-017 — Long-press ANR (main-thread block in libminikin).
STA-020 — Address-bar focus ANR (main-thread block in libminikin).

Forensic evidence from a production bugreport (2026-09-06) confirms the full failure chain from oversized Bundle to Binder transaction failure to process termination. The September 2026 Android Security Bulletin contains no patches for the affected paths.

The evidence indicates that the issue is not confined to a specific browser implementation. Chromium-only mitigations cannot fully address the demonstrated Android text-processing and Binder execution paths. A platform-level fix in AOSP appears necessary.

Lostmon Blogger