Skip to content
OpenAdvisories

Weakness (CWE)

CWE-926: Improper Export of Android Application Components

Variant Incomplete

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

How to prevent it (4 mitigations)

  1. Build and Compilation

    If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.

  2. Build and Compilation

    If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.

  3. Build and Compilation, Architecture and Design

    Limit Content Provider permissions (read/write) as appropriate.

  4. Build and Compilation, Architecture and Design

    Limit Content Provider permissions (read/write) as appropriate.

Source: MITRE CWE-926

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Low 2.5
    CVE-2026-86701

    Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its componen…

    NTT DOCOMO BUSINESS ManabiPocket for Parents
  • Low 2.8
    CVE-2024-3479

    An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterpr…

    Motorola Phones
  • Low 3.9
    CVE-2024-27086

    MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service

    The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A mali…

    AzureAD microsoft-authentication-library-for-dotnet Microsoft.Identity.Client NuGet
  • Low 3.6
    CVE-2023-44129

    Messaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivity

    The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by lau…

    LG Electronics LG V60 Thin Q 5G(LMV600VM)
  • Low 3.8
    CVE-2021-25527

    Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 all…

    Samsung Mobile Samsung Pay