#3936905 — arbitrary file write via onBlobContent

Reproduction for triage. No root, no adb, no external storage. Context:
Open the feature flag screen
This replaces the app's AsyncStorage database. The app regenerates the keys it needs on next launch, including a fresh machine_identifier. You stay signed in. Clearing app storage restores the original state.
  1. Make sure the Stripe app is installed and signed in, then close it from recents.
  2. Enter your account id above and tap Run the write. Tap the link — do not paste it into the address bar, since typing a URL does not trigger App Link handling.
  3. The app opens its in-app browser on this page, which then calls Android.onBlobContent with a traversing filename.
  4. Close the app from recents and reopen it. The database is cached in memory, so checking without a full restart shows the stale copy.
  5. Tap Open the feature flag screen. Two overrides are on and every other flag is off.