STA-005 WhatsApp: When a large draft becomes a persistent crash loop in a APP
Structured Text Amplification — Vector 005
This post is part of the series documenting the 32 vectors of Structured Text Amplification (STA). The complete whitepaper, version v5, covers the research, methodology, evidence, and full vector catalog.
If you read STA-001 and STA-002, you saw how oversized URLs can affect interaction surfaces like context menus and share dialogs. STA-005 is different: it's not about a UI surface, it's about persistent state amplification that can lock the entire application.
⚠️ Severity: STA-005 is one of the most severe Class A vectors. A single oversized text pasted into a WhatsApp chat can cause a persistent crash loop that typically resolves only by deleting the conversation or clearing app data.
1. The scenario
The scenario is deceptively simple:
User pastes large text into WhatsApp chat compose field
↓
WhatsApp stores the draft in a Fragment (SavedState)
↓
FragmentManager attempts to restore the oversized state
↓
The serialized activity state subsequently crosses the Binder boundary
↓
State exceeds the Binder transaction budget used in the observed reproduction
↓
TransactionTooLargeException results in process termination in the observed reproduction
↓
WhatsApp crashes
↓
The contaminated state remains persisted to disk
↓
WhatsApp crashes again on next launch when restoring the same state
↓
PERSISTENT CRASH LOOP — user may be unable to open the app until the contaminated state is removed
↓
Recovery: delete conversation via adb or clear app data
The user does nothing malicious. They paste a large text — perhaps from a document, a long URL, or a generated payload — and the app becomes persistently unusable until the corrupted state is removed.
2. The amplification mechanism
STA-005 is a textbook example of Class A amplification:
Structured input (text draft)
↓
Fragment state (SavedState)
↓
Bundle serialization
↓
Parcel (Binder transaction)
↓
Exceeds Binder transaction budget
↓
TransactionTooLargeException → crash
↓
State remains persisted → loop on next restore
The key architectural failure is not that the Bundle exceeds the Binder budget. The failure is that the system has no safe degradation mechanism at this boundary:
- It does not catch
TransactionTooLargeException
- It does not discard oversized state
- It does not fall back to a clean start
- Instead, it crashes, and the same contaminated state is restored on the next launch
The interesting property is not that Android has a 1 MB Binder limit. The interesting property is that a relatively small, valid piece of application data can become substantially larger state as it crosses framework boundaries, and that failure at the boundary can become persistent application state rather than a recoverable error.
3. The stack trace and Bundle analysis
The following log output was captured from a production device (WhatsApp, Android 15) after pasting an 80,484-byte draft.
W/Bundle: childFragmentManager [L1] size=1,636,412
W/Bundle: childFragmentManager [L2] size=1,614,072
W/Bundle: childFragmentManager [L3] size=1,603,852
W/Bundle: registryState size= 479,948
W/Bundle: compose_text (origin) size= 80,484 ← input data
W/Bundle: TOTAL size=1,661,088 ← +58% over the observed Binder budget
Amplification factor
The input was 80,484 bytes of text. The total Bundle size was 1,661,088 bytes.
Measured amplification factor: ×20.6
The analysis indicates that encoding (UTF-16) and framework serialization overhead contribute to this expansion, but the factor should be treated as an empirical measurement rather than as the sum of two fixed multipliers.
Stack trace
The exception occurs when the serialized activity state crosses the Binder boundary. The following excerpt is abbreviated; irrelevant frames and build-specific details have been omitted:
android.os.TransactionTooLargeException: data parcel size 1661088 bytes
at android.os.BinderProxy.transactNative(Native Method)
at android.os.BinderProxy.transact(BinderProxy.java)
at android.app.ActivityManagerProxy.activityStopped(ActivityManagerProxy.java)
at android.app.ActivityThread.handleStopActivity(ActivityThread.java)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java)
at android.os.Handler.dispatchMessage(Handler.java)
at android.os.Looper.loop(Looper.java)
at android.app.ActivityThread.main(ActivityThread.java)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java)
Note: The frames above are shown without line numbers to avoid presenting build-specific line numbers as authoritative. They are intended to illustrate the code path, not to serve as an exact reconstruction of the original stack trace. The exception results in process termination in the observed reproduction.
4. Variants
STA-005b — WhatsApp Business (shared inbox)
When a conversation's SavedState becomes contaminated in WhatsApp Business, the crash loop can affect ALL agents in a shared inbox simultaneously.
- All agents may see the same crash loop
- No agent can access the conversation
- The only recovery (deleting the conversation) destroys the entire communication history with that client
Impact: Potential business continuity impact. A single oversized message can lock an entire customer service team out of a conversation.
STA-005c — WhatsApp + Meta AI
An oversized draft in a Meta AI chat within WhatsApp can lock the entire application persistently.
- The draft is stored in the AI chat's SavedState
- Same amplification mechanism
- Recovery typically requires clearing the entire app data
STA-005d — WhatsApp deep link (api.whatsapp.com/send?text=[payload])
A potential one-click delivery path: an attacker can craft a deep link that opens WhatsApp with a pre-filled text field containing an oversized payload:
https://api.whatsapp.com/send?text=[OVERSIZED_PAYLOAD]
- The user clicks the link
- WhatsApp opens with the text pre-filled
- If the text is persisted as a draft (depending on WhatsApp's draft persistence behaviour), the state becomes contaminated
- If the user sends the message, the state is also contaminated through the normal message flow
Note: The exact conditions under which the payload contaminates the state without the user sending the message depend on WhatsApp's draft persistence implementation. This is documented as a potential delivery path rather than a guaranteed one-click vector.
5. Affected apps and devices
Confirmed apps:
- WhatsApp — reproducible on the tested versions across Android 13–16
- WhatsApp Business — reproducible on the tested versions (shared inbox)
- WhatsApp + Meta AI chat — reproducible on the tested versions
- Threads (STA-012, similar mechanism)
- Other apps with similar SavedState/Binder patterns (Bing, Opera, DuckDuckGo, Firefox)
Devices tested:
- Xiaomi Redmi Note 14 5G (HyperOS 3.0 / Android 16)
- Google Pixel 7 (Android 13–15)
- OPPO A78 (ColorOS, Android 14)
- OnePlus 11 (OxygenOS, Android 14)
- Samsung Galaxy series (One UI, Android 14–15)
Reproducibility: 100% on all tested devices.
6. Persistence
Persistence: YES
The contaminated state is written to disk. The crash loop persists across:
- App restarts
- Device reboots
- App updates (if the state is preserved)
Recovery typically requires:
- Deleting the contaminated conversation (via
adb or app settings if accessible)
- Clearing the entire app data (loses all conversations)
- Reinstalling the app (loses all data)
7. Why this matters
STA-005 is not just a crash. It is a persistent denial of service with potential data loss implications:
- For individual users: They lose access to the app until they clear data, losing all chat history
- For businesses (WhatsApp Business): An entire customer service team can be locked out of a client conversation
- For the platform: This is a single point of failure in the state restoration mechanism
A sufficiently small structured input can, through state amplification, produce a serialized state large enough to trigger the crash condition. The measured amplification factor (×20.6) demonstrates that this transformation is not merely theoretical.
8. Relationship to other STA vectors
| Vector |
Relationship |
| STA-012 |
Same mechanism (Threads deep link → Fragment args → SavedState → Binder) |
| STA-015-DL |
Same amplification mechanism, escalated to SystemUI via TaskPersister |
| STA-022 |
Same mechanism (DuckDuckGo Fragment args → Parcel → Binder) |
| STA-028 |
UTF-16 encoding amplification is a contributing factor to the measured ×20.6 |
9. Vendor status
| Vendor |
Status |
| Meta (WhatsApp/Threads) |
❌ Reported in March 2026 — no response as of 17 August 2026 |
| Google (Android VRP) |
✅ A-477279924 — $250 reward, open triage |
| Google (AndroidX) |
✅ savedstate 1.5.0 (May 2026) decouples SavedState from Binder for AndroidX consumers — but does not fix FragmentManager or SystemUI |
Note: Updating to androidx.savedstate 1.5.0 does not protect against STA-005. WhatsApp must update their own state handling, and FragmentManager.restoreAllState() itself remains unpatched.
10. Recommended mitigation
For WhatsApp and other apps:
- Truncate text input in chat compose fields (max 8–16 KB)
- Validate draft size before saving to SavedState
- Catch
TransactionTooLargeException in state restoration and fall back to clean start
For the Android framework:
FragmentManager.restoreAllState() should catch TransactionTooLargeException and discard oversized stateTaskPersister should validate state size before persisting- SystemUI should treat corrupted task state as transient and degrade gracefully
馃搶 The fundamental fix: State restoration must be resilient. A single oversized Bundle should not make the entire app persistently unusable.
11. Methodological note
STA-005 is Tier A — Confirmed. Full stack trace and Bundle analysis have been captured from production devices. The amplification factor (×20.6) is empirically measured.
This vector is one of the most severe in the STA catalog because of its persistence, potential data loss implications, and impact on business users (WhatsApp Business).
Complete whitepaper: Resilience Gaps in Android IPC, SavedState and Text Layout — v5 (August 2026)
— Lostmon · lostmon.blogspot.com
Posts
