Skip to content
OpenAdvisories

Weakness (CWE)

CWE-926: Improper Export of Android Application Components

Variant Incomplete

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

How to prevent it (4 mitigations)

  1. Build and Compilation

    If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.

  2. Build and Compilation

    If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.

  3. Build and Compilation, Architecture and Design

    Limit Content Provider permissions (read/write) as appropriate.

  4. Build and Compilation, Architecture and Design

    Limit Content Provider permissions (read/write) as appropriate.

Source: MITRE CWE-926

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-107057

    An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.

  • Critical 9.1
    CVE-2026-107027

    Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exporte…

  • Critical 9.1
    CVE-2026-107021

    Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows …

  • Critical 9.1
    CVE-2026-107043

    Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's S…

  • Critical 9.1
    CVE-2026-107032

    Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an …

  • Critical 9.1
    CVE-2026-107040

    Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported componen…

  • Critical 9.1
    CVE-2026-107038

    Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an export…

  • Critical 9.1
    CVE-2026-107014

    Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read n…

  • Critical 9.8
    CVE-2026-107048

    An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execut…