Skip to content
OpenAdvisories

Weakness (CWE)

CWE-926: Improper Export of Android Application Components

Variant Incomplete

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

How to prevent it (4 mitigations)

  1. Build and Compilation

    If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.

  2. Build and Compilation

    If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.

  3. Build and Compilation, Architecture and Design

    Limit Content Provider permissions (read/write) as appropriate.

  4. Build and Compilation, Architecture and Design

    Limit Content Provider permissions (read/write) as appropriate.

Source: MITRE CWE-926

All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • High 8.2
    CVE-2026-54376

    VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking

    VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can ca…

    Shenzhen Shine Industrial VitaFit
  • High 7.5
    CVE-2026-107059

    An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switc…

  • High 7.5
    CVE-2026-107030

    Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger…

  • High 7.5
    CVE-2026-107051

    Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to ar…

  • High 7.5
    CVE-2026-107025

    Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export …

  • High 8.8
    CVE-2026-107019

    Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthor…

  • High 7.5
    CVE-2026-107041

    Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized …

  • High 8.6
    CVE-2026-68928

    Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode

    Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/sr…

    Acode-Foundation Acode
  • High 8.5
    CVE-2026-81301

    Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access

    Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(…

    Ekia File Manager
  • High 7.1
    CVE-2026-18994

    A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distribut…

    Lenovo File Manager Application
  • High 7.3
    CVE-2026-45528

    In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsaf…

    Google Android Android
  • High 7.1
    CVE-2026-54318

    Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location

    Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a …

    home-assistant core
  • High 8.0
    CVE-2025-68713

    An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. …

  • High 7.5
    CVE-2025-15464

    KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

    Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.

    yintibao Fun Print Mobile
  • High 7.8
    CVE-2025-32347

    In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an un…

    Google Android Android
  • High 8.5
    CVE-2025-5344

    Exposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk application

    Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemoteService". A local attacker can bind to the AIDL-type service to modify device's global settings and…

    Bluebird com.bluebird.kiosk.launcher
  • High 8.3
    CVE-2024-13917

    Intent Injection in Kruger&Matz AppLock application

    An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.pri.applock.LockUI“ activity allows any other malicious applicatio…

    Krüger&Matz com.pri.applock
  • High 7.1
    CVE-2023-41960

    The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafel…

    Rexroth ctrlX HMI Web Panel - WR21 (WR2107) ctrlX HMI Web Panel - WR21 (WR2115) ctrlX HMI Web Panel - WR21 (WR2110)
  • High 7.1
    CVE-2021-25388

    Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary …

    Samsung Mobile Samsung Mobile Devices