What is the Broadcast Theft (intent sniffing) attack on unprotected dynamic broadcasts and what is the protection?

• A.A) An unprotected dynamic broadcast (registered without a permission requirement) can be received by any app on the device with a matching intent filter; a malicious background app listening for the victim app's custom broadcasts can silently harvest session tokens, authentication codes, or business logic triggers included in the broadcast payload. Protection: use LocalBroadcastManager for intra-app broadcasts (or the Kotlin equivalent EventBus/Flow), or registerReceiver with a signature-level permission.
• B.B) Dynamic broadcasts are always local to the registering app; no other app can receive them regardless of intent filter matching.
• C.C) The Android kernel encrypts broadcast Extras with the sender's UID key; only the intended receiver can decrypt them.