CWE-926Improper Export of Android Application Components

Description

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

[object Object]

Common consequences

• Availability,Integrity→Unexpected State,DoS: Crash, Exit, or Restart,DoS: Instability,Varies by Context
  Other applications, possibly untrusted, can launch the Activity.
• Availability,Integrity→Unexpected State,Gain Privileges or Assume Identity,DoS: Crash, Exit, or Restart,DoS: Instability,Varies by Context
  Other applications, possibly untrusted, can bind to the Service.
• Confidentiality,Integrity→Read Application Data,Modify Application Data
  Other applications, possibly untrusted, can read or modify the data that is offered by the Content Provider.

Potential mitigations

• Build and Compilation
  If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.
• Build and Compilation
  If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.
• Build and Compilation,Architecture and Design
  Limit Content Provider permissions (read/write) as appropriate.
• Build and Compilation,Architecture and Design
  Limit Content Provider permissions (read/write) as appropriate.

Related CWEs

Recent CVEs classified under this CWE