Android DataSharing cross-thread UAF/double-free trigger

Tap the link below (user gesture required so DataSharingNavigationThrottle intercepts the navigation). The t= access_token is 200 ASCII bytes (≥128), so the serialized ReadGroupWithTokenParams length varint is 0xC8 0x01. ConvertUTF8ToJavaString() replaces the high-bit byte with U+FFFD; Java-side parseFrom() throws InvalidProtocolBufferException; the catch handler posts the native callback to a ThreadPool worker (TaskTraits.USER_VISIBLE) instead of the UI thread.

Join shared tab group (trigger)

Second link (race via CancelAllFlows)