Weakness (CWE)
CWE-926: Improper Export of Android Application Components
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
How to prevent it (4 mitigations)
-
Build and Compilation
If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.
-
Build and Compilation
If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.
-
Build and Compilation, Architecture and Design
Limit Content Provider permissions (read/write) as appropriate.
-
Build and Compilation, Architecture and Design
Limit Content Provider permissions (read/write) as appropriate.
Source: MITRE CWE-926
119 results · Feed
-
High 8.2
VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can ca…
-
Medium 5.1
Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exp…
-
Medium 6.5
Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthoriz…
-
Critical 9.8
An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.
-
Critical 9.1
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exporte…
-
High 7.5
An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switc…
-
Medium 5.3
A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows at…
-
Critical 9.1
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows …
-
High 7.5
Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger…
-
Critical 9.1
Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's S…
-
High 7.5
Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to ar…
-
Critical 9.1
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an …
-
High 7.5
Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export …
-
Critical 9.1
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported componen…
-
Critical 9.1
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an export…
-
High 8.8
Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthor…
-
Critical 9.1
Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read n…
-
High 7.5
Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized …
-
Critical 9.8
An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execut…
-
Medium 5.3
LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application component…
-
Medium 6.9
Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers …
-
High 8.6
Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/sr…
-
Low 2.5
Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its componen…
-
High 8.5
Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(…
-
High 7.1
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distribut…
-
Medium 4.8
Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attacker…
-
Medium 6.9
Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to a…
-
High 7.3
In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsaf…
-
Medium 5.5CVE-2026-20516 Public exploit
In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local deni…
-
Medium 5.1
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attacke…
-
Medium 6.8
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers …
-
Medium 6.9
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local atta…
-
Medium 5.5
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWi…
-
Medium 6.3
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts …
-
Medium 6.4
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission g…
-
Medium 5.3
textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components
A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack…
-
Medium 6.2
In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local in…
-
Medium 5.5
Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation
Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra.…
-
Medium 6.0CVE-2026-12960 Public exploit
An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application …
-
High 7.1
Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a …