The vulnerability in Stoat for Android involves the exported ShareTargetActivity component that handles the android.intent.action.SEND intent with a file URI passed via android.intent.extra.STREAM. The activity fails to validate or filter the incoming URI, allowing an attacker with the ability to send intents on the victim's device to specify internal file URIs (e.g., app databases, cached tokens). When the victim selects a channel to share with, the app sends the internal file as an attachment without user-visible indication of its sensitive nature. This results in unauthorized disclosure of internal application data and authentication tokens, enabling potential account compromise.

An attacker capable of invoking intents on the victim's device can cause the victim to unknowingly send sensitive internal files to attacker-controlled channels. This can disclose the local Stoat database containing message history, contacts, cached content, and authentication tokens. Disclosure of authentication tokens can lead to full account takeover. The vulnerability does not affect availability or integrity but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor applications and processes that can send intents to Stoat for Android, and limit ADB or other access that could be used to invoke intents maliciously. Users should be cautious about co-installed apps that might exploit this behavior.