What is an implicit Intent data leak and how does a malicious app intercept sensitive data from one?

• A.Implicit Intents used for data sharing require the SEND_DATA permission on the receiving side; the PackageManager filters the chooser list down to the holders of that permission before it is displayed (the grant is declared at protectionLevel normal). An app without the permission is absent from the chooser, and the sensitive document stays with the handlers the user has already trusted for that particular MIME type and action.
• B.An implicit Intent is delivered to the single app whose intent filter carries the highest declared priority value, and the chooser appears in the event of a tie alone (IntentResolver sorts by android:priority before presentation). A malicious app registering a generic filter at the default priority is outranked by the legitimate handler, and interception needs a manifest priority that Play policy rejects at review time.
• C.An implicit Intent (ACTION_SEND, ACTION_VIEW with a MIME type) does not specify a target component; the OS shows an app chooser, and any installed app that declares a matching intent filter can receive it. A malicious app registering a generic intent filter (ACTION_SEND, type="text/plain") can appear in the chooser and receive sensitive data (documents, passwords, authentication tokens) sent by the victim app.