Microsoft warns of "Dirty Stream" attack impacting Android apps

Microsoft disclosed a vulnerability dubbed 'Dirty Stream' in which malicious Android apps can abuse improperly implemented content providers and custom intents to send manipulated filenames or paths that cause target apps to write or execute files in sensitive directories, risking arbitrary code execution and data/secret theft. The researchers identified the pattern in apps representing over four billion installations (notably Xiaomi File Manager and WPS Office), worked with vendors to deploy fixes, and prompted Android/Google to update developer guidance; users are advised to keep apps updated and avoid untrusted APK sources.