“Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps

Microsoft Threat Intelligence describes a widespread Android path-traversal vulnerability pattern in content providers/FileProvider where a malicious app can supply crafted content URIs and filenames to cause share-target apps to write files into their internal storage, enabling arbitrary code execution and credential theft; the blog includes a Xiaomi File Manager case study (native library replacement and SMB/FTP credential exfiltration), notes affected high-installation apps (over 4 billion installs across identified apps), documents coordinated disclosure and fixes, and provides developer/user remediation guidance.