Executive brief
Stoat for Android is a messaging application. A security flaw allows other malicious apps on the same device to trick Stoat into sending its own private data—such as message history, contact lists, and login tokens—to an external recipient. This could lead to a full account takeover or the theft of private conversations without the user realizing which file is being sent.
Technical details
Stoat for Android (versions prior to 1.6.0) improperly exports the 'chat.stoat.activities.ShareTargetActivity' component, making it accessible to any process on the device via the 'android.intent.action.SEND' intent. The activity fails to validate or filter incoming URIs provided in the 'android.intent.extra.STREAM' extra. A local attacker or malicious application can craft an intent with a 'file://' URI pointing to Stoat's internal storage (e.g., databases or preference files). If a user interacts with the resulting share prompt, the app will transmit the internal file to a chosen channel. This can result in the disclosure of authentication tokens, message databases, and other sensitive application data. The issue was fixed in version 1.6.0.
Affected products
- stoatchat Stoat for Android < 1.6.0
Timeline
- 2026-07-18: disclosed
- 2026-07-18: advisory
- 2026-07-18: patched: Fixed in version 1.6.0 via commit 50d5f51