Stoat for Android contains an exported ShareTargetActivity that accepts a URI in the android.intent.extra.STREAM extra without validation, allowing an attacker to point the intent at files in the app’s internal storage such as databases, authentication tokens, or preferences. When the activity is invoked the selected internal file is sent as an attachment to any chosen channel, and the app displays it simply as "attachment" with no filename, so the user is unaware that sensitive internal data is being transmitted. The impact is disclosure of the local Stoat database, cached tokens, or any other file readable by the app process, potentially enabling full account takeover.

The vulnerability affects the stoatchat Stoat for Android application. No specific version information is provided in the available data, so any build that includes the exposed ShareTargetActivity without proper URI validation is considered at risk.

The CVSS score of 6.8 classifies the flaw as a moderate severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending a specially crafted intent via ADB, a co-installed malicious app, or any other means that reach the Android intent dispatch system. The attack requires the ability to invoke an intent with the SEND action and the extra.STREAM URI, and it can be carried out with a single user interaction during channel selection. All conditions for exploitation are reasonably easy on a compromised device, making the risk significant for users who have granted the app such intent privileges.