A popular Android cropper library's defaults quietly opened thousands of apps to arbitrary file overwrite
A researcher shows the widely used CanHub Image-Cropper ships android:exported="true" on its activity and root-scoped FileProvider paths as manifest defaults, so every app importing it inherits the attack surface without writing a line of vulnerable code. A rogue app can launch the activity and trigger arbitrary file read/write with no signature or caller check. The writeup walks the full chain and the fix: override the manifest at merge time.