CVE-2026-57848 describes a vulnerability in Stoat for Android where the ShareTargetActivity component is exported and reachable by any process via the android.intent.action.SEND intent. The activity accepts a file URI through the android.intent.extra.STREAM extra but does not validate or filter this URI before using it as an outgoing attachment. An attacker with the ability to invoke intents on the victim's device can supply a file URI pointing to the app's internal storage (e.g., databases, cached tokens) and cause the victim to unknowingly send these internal files to an attacker-controlled Stoat channel or user. The attachment is shown generically as "attachment" without filename, providing no indication to the user that sensitive internal files are being shared. This leads to potential disclosure of message history, contact lists, cached content, authentication tokens, and other readable files by the app process.

The vulnerability allows local attackers or malicious apps with the ability to send intents on the victim's device to exfiltrate sensitive internal application data, including message history, contact lists, cached content, and authentication tokens. Disclosure of authentication tokens can result in full account takeover. The victim is not alerted to the sensitive nature of the attachment, increasing the risk of unnoticed data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict which apps have the ability to send intents to Stoat and avoid granting unnecessary permissions that allow intent invocation. Monitoring for suspicious inter-app communication may help detect exploitation attempts.