What is the Broadcast Theft (intent sniffing) attack on unprotected dynamic broadcasts and what is the protection?

• A.A dynamic broadcast stays local to the registering app, with the framework refusing delivery to a receiver living in another process (Context.registerReceiver binds the filter to the calling uid). A malicious background app listening for the victim's custom action receives nothing whatever, however its intent filter is declared. Protection: the registration itself is the control; a developer needs no permission string, no LocalBroadcastManager dependency, no signature-level declaration in the manifest for the receiver.
• B.An unprotected dynamic broadcast (registered without a permission requirement) can be received by any app on the device with a matching intent filter; a malicious background app listening for the victim app's custom broadcasts can silently harvest session tokens, authentication codes, or business logic triggers included in the broadcast payload. Protection: use LocalBroadcastManager for intra-app broadcasts (or the Kotlin equivalent EventBus/Flow), or registerReceiver with a signature-level permission.