CVE-2026-57848: Stoat for Android Information Disclosure

CVE-2026-57848 Overview

CVE-2026-57848 affects Stoat for Android, where the exported chat.stoat.activities.ShareTargetActivity component accepts unvalidated file:// URIs through the android.intent.extra.STREAM extra. Any local process that can dispatch Android intents can direct the app to treat its own internal files as user-supplied attachments. A single victim tap on channel selection then transmits sensitive internal data, including the local database and cached authentication tokens, to an attacker-controlled destination.

Critical Impact
Successful exploitation enables disclosure of the Stoat database (/data/data/chat.revolt/databases/revolt.db), cached authentication tokens permitting full account takeover, and any other file readable by the app process.

Affected Products

Stoat for Android (chat.stoat) prior to the fix in commit 50d5f51
Android devices running the vulnerable Stoat client
Stoat accounts whose tokens reside in app-private storage on affected devices

Discovery Timeline

2026-07-18 - CVE-2026-57848 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-57848

Vulnerability Analysis

The flaw is an unrestricted URI handling issue [CWE-926] in an exported Android activity. ShareTargetActivity is declared to receive android.intent.action.SEND broadcasts from any process on the device. The activity reads the attachment URI directly from the intent extra android.intent.extra.STREAM and forwards it into the outgoing message composer without validating the scheme, authority, or path.

Because the app process itself opens the URI when preparing the attachment, a file:// URI pointing at the app's own private directory resolves under the app's UID. Android's per-app sandbox does not block the read because the request originates inside the sandbox. The composer renders the attachment label as "attachment" with no filename, hiding the true source from the victim.

Root Cause

The root cause is missing input validation on an inter-process communication (IPC) boundary. ShareTargetActivity is exported and reachable by any caller, yet it trusts a caller-supplied URI without restricting it to content providers external to the app or verifying that the URI does not point at private application storage.

Attack Vector

An attacker requires local intent dispatch capability, obtained via a co-installed malicious app, Android Debug Bridge (ADB) access, or another route that reaches the intent dispatcher. The attacker crafts an ACTION_SEND intent targeting chat.stoat/.activities.ShareTargetActivity and sets EXTRA_STREAM to a file:// URI referencing internal state such as the SQLite database or a preferences file. When the victim selects any channel, the app uploads the attacker-chosen internal file to that destination.

text

// Security patch in app/src/main/java/chat/stoat/activities/ShareTargetActivity.kt
// fix(security): CVE-2026-57848
 package chat.stoat.activities
 
+import android.content.ContentResolver
+import android.content.Context
 import android.content.Intent
 import android.net.Uri
 import android.os.Build

Source: GitHub Commit 50d5f51. The patch introduces ContentResolver and Context imports, indicating the fix rejects raw file:// URIs and requires attachments to resolve through a content resolver.

Detection Methods for CVE-2026-57848

Indicators of Compromise

Outbound Stoat messages containing an attachment labeled simply attachment with no filename displayed to the sender.
Presence of unexpected attachments in Stoat channels whose payload matches the schema of the local revolt.db SQLite database.
Logcat entries showing ShareTargetActivity receiving ACTION_SEND intents originating from packages other than trusted system share sheets.

Detection Strategies

Monitor Android application logs and dumpsys activity output for external invocations of chat.stoat.activities.ShareTargetActivity with EXTRA_STREAM values using the file:// scheme.
Inspect installed application manifests for packages that declare intent filters targeting Stoat, and review their permissions and origin.
On managed fleets, run static analysis to detect any co-installed app that constructs ACTION_SEND intents targeting the chat.stoat package.

Monitoring Recommendations

Enable Mobile Threat Defense telemetry to flag ADB debugging sessions on production devices and unauthorized sideloaded applications.
Alert on Stoat account activity from unexpected clients, which may indicate token replay following disclosure of cached authentication material.
Correlate device-level intent dispatch anomalies with account-level authentication events across the security data lake.

How to Mitigate CVE-2026-57848

Immediate Actions Required

Update Stoat for Android to the build containing commit 50d5f51 or later.
Rotate Stoat authentication tokens and force re-login on any device suspected to have run a vulnerable version alongside untrusted applications.
Revoke ADB authorizations on user devices and disable USB debugging where not operationally required.

Patch Information

The upstream fix is available in GitHub Commit 50d5f51 of the Stoat for Android repository. Full technical detail is documented in the VulnCheck Advisory on Stoat. The patch introduces content-resolver-based URI handling in ShareTargetActivity.kt so that private file:// paths are no longer accepted as attachments.

Workarounds

Uninstall Stoat for Android on devices where the patched build cannot be deployed and untrusted applications may be present.
Restrict device provisioning to prevent sideloading of unverified applications through mobile device management (MDM) policies.
Avoid enabling ADB or granting USB debugging authorization on devices used to access Stoat accounts.

bash

# Verify the installed Stoat build includes the fix commit
adb shell dumpsys package chat.stoat | grep versionName
# Confirm ShareTargetActivity is no longer exported or accepts file:// URIs
adb shell dumpsys package chat.stoat | grep -A2 ShareTargetActivity