Stoat for Android CVE-2026-57848

Exploitation requires the ability to dispatch an explicit intent to the exported ShareTargetActivity component on the victim's device, achievable via: a co-installed malicious Android application (no special Android permissions are required to send intents to exported activities of other apps), ADB shell access to the device, or any other local mechanism capable of constructing and sending an intent. The victim must complete a single channel-selection interaction in the Stoat share composer; the composer displays no filename information, making the interaction appear legitimate and reducing victim detection likelihood. Exploitation is strictly limited to the local attack surface - no network-based remote exploitation is possible. The target file must be readable by the Stoat app process, which encompasses the full internal data directory including the SQLite database and token caches. No non-default configuration is required; the exported ShareTargetActivity is present and reachable in default Stoat installations on all versions prior to the commit-50d5f5 fix.

The CVSS 3.1 score of 5.5 (Medium) is anchored by AV:L, which correctly constrains the attacker to the local device - remote exploitation is not possible. PR:N is accurate because sending explicit intents to exported Android activities requires no special Android permissions; any co-installed app can perform this. UI:R reflects the required single channel-selection step, which is low-friction and visually deceptive given the absent filename indicator. The C:H component is the most significant signal: successful exploitation yields full disclosure of authentication tokens enabling account takeover, plus the entire local message database and contacts. No EPSS data was provided in the input, and the vulnerability does not appear in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. Real-world risk is moderate-to-high in targeted threat models - spyware paired with Stoat, or a device under ADB access by an adversary - but mass exploitation is structurally limited by the local attack vector requirement. The deceptive UX (no filename shown in composer) meaningfully increases the probability of victim completion, which elevates practical exploitability above what the medium CVSS score alone suggests.

A malicious application co-installed on the victim's device constructs an ACTION_SEND intent explicitly targeting chat.stoat.activities.ShareTargetActivity, populating android.intent.extra.STREAM with a file:// URI pointing to /data/data/chat.revolt/databases/revolt.db. Stoat launches its share composer displaying the attachment only as 'attachment' with no filename, and when the victim selects a channel or contact and taps send - a routine-appearing one-tap action - the entire local database including message history and cached authentication tokens is uploaded to an attacker-controlled Stoat destination. No public exploit code has been identified, but the attack requires only standard Android SDK APIs available to any installed application without special permissions.