Weakness (CWE)
CWE-926: Improper Export of Android Application Components
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
How to prevent it (4 mitigations)
-
Build and Compilation
If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.
-
Build and Compilation
If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.
-
Build and Compilation, Architecture and Design
Limit Content Provider permissions (read/write) as appropriate.
-
Build and Compilation, Architecture and Design
Limit Content Provider permissions (read/write) as appropriate.
Source: MITRE CWE-926
85 results · Clear filters · Feed
-
Medium 5.1
Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exp…
-
Medium 6.5
Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthoriz…
-
Medium 5.3
A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows at…
-
Medium 5.3
LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application component…
-
Medium 6.9
Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers …
-
Medium 4.8
Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attacker…
-
Medium 6.9
Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to a…
-
Medium 5.5CVE-2026-20516 Public exploit
In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local deni…
-
Medium 5.1
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attacke…
-
Medium 6.8
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers …
-
Medium 6.9
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local atta…
-
Medium 5.5
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWi…
-
Medium 6.3
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts …
-
Medium 6.4
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission g…
-
Medium 5.3
textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components
A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack…
-
Medium 6.2
In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local in…
-
Medium 5.5
Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation
Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra.…
-
Medium 6.0CVE-2026-12960 Public exploit
An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application …
-
Medium 5.0
An improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, Fort…
-
Medium 6.9
Samsung Print Service Plugin – Potential Information Disclosure
Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.
-
Medium 5.3
Yalantis uCrop AndroidManifest.xml UCropActivity improper export of android application components
A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity of the file AndroidManifest.xml. Executing manipulation can lead to improper export of android application components. The attack can only be executed locally. T…
-
Medium 5.3
SKTLab Mukbee App com.dw.android.mukbee AndroidManifest.xml improper export of android application components
A vulnerability was detected in SKTLab Mukbee App 1.01.196 on Android. This affects an unknown function of the file AndroidManifest.xml of the component com.dw.android.mukbee. The manipulation results in improper export of android application components. The …
-
Medium 5.3
Webull Investing & Trading App AndroidManifest.xml improper export of android application components
A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml. This manipulation causes improper export of android application components. The attack can only be …
-
Medium 5.3
Ooma Office Business Phone App com.ooma.office2 improper export of android application components
A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be approache…
-
Medium 5.3
intsig CamScanner App com.intsig.camscanner AndroidManifest.xml improper export of android application components
A vulnerability has been found in intsig CamScanner App 6.91.1.5.250711 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.intsig.camscanner. The manipulation leads to improper export of andro…
-
Medium 5.3
Creality Cloud App com.cxsw.sdprinter AndroidManifest.xml improper export of android application components
A flaw has been found in Creality Cloud App up to 6.1.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.cxsw.sdprinter. Executing manipulation can lead to improper export of android a…
-
Medium 5.3
APEUni PTE Exam Practice App com.ape_edication AndroidManifest.xml improper export of android application components
A security flaw has been discovered in APEUni PTE Exam Practice App up to 10.8.0 on Android. The impacted element is an unknown function of the file AndroidManifest.xml of the component com.ape_edication. The manipulation results in improper export of android…
-
Medium 5.3
Seismic App com.seismic.doccenter AndroidManifest.xml improper export of android application components
A vulnerability has been found in Seismic App 2.4.2 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.seismic.doccenter. Such manipulation leads to improper export of android application components. An attack has…
-
Medium 5.3
ZhenShi Mibro Fit App com.xiaoxun.xunoversea.mibrofit AndroidManifest.xml improper export of android application components
A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.xiaoxun.xunoversea.mibrofit. This manipulation causes improper export of android application component…
-
Medium 5.3
GalleryVault Gallery Vault App com.thinkyeah.galleryvault AndroidManifest.xml improper export of android application components
A vulnerability was identified in GalleryVault Gallery Vault App up to 4.5.2 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.thinkyeah.galleryvault. The manipulation leads to improper expor…
-
Medium 5.3
Modo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application components
A security flaw has been discovered in Modo Legend of the Phoenix up to 1.0.5. The affected element is an unknown function of the file AndroidManifest.xml of the component com.duige.hzw.multilingual. The manipulation results in improper export of android appl…
-
Medium 5.3
NCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application components
A vulnerability was identified in NCSOFT Universe App up to 1.3.0. Impacted is an unknown function of the file AndroidManifest.xml of the component com.ncsoft.universeapp. The manipulation leads to improper export of android application components. Local acce…
-
Medium 5.3
Voice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application components
A vulnerability was determined in Voice Changer App up to 1.1.0. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.tuyangkeji.changevoice. Executing manipulation can lead to improper export of android application …
-
Medium 5.3
Transbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application components
A flaw has been found in Transbyte Scooper News App up to 1.2 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.hatsune.eagleee. This manipulation causes improper export of android applicatio…
-
Medium 5.3
Kakao 헤이카카오 Hey Kakao App com.kakao.i.connect AndroidManifest.xml improper export of android application components
A vulnerability was detected in Kakao 헤이카카오 Hey Kakao App up to 2.17.4 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.kakao.i.connect. The manipulation results in improper export of …
-
Medium 5.3
Rejseplanen App de.hafas.android.rejseplanen AndroidManifest.xml improper export of android application components
A security vulnerability has been detected in Rejseplanen App up to 8.2.2. Affected is an unknown function of the file AndroidManifest.xml of the component de.hafas.android.rejseplanen. The manipulation leads to improper export of android application componen…
-
Medium 5.3
UAB Paytend App com.passport.cash AndroidManifest.xml improper export of android application components
A weakness has been identified in UAB Paytend App up to 2.1.9 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.passport.cash. Executing manipulation can lead to improper export of android application components…
-
Medium 5.3
Verkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application components
A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1(258) on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper ex…
-
Medium 5.3
AfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application components
A security vulnerability has been detected in AfterShip Package Tracker App up to 5.24.1 on Android. The affected element is an unknown function of the file AndroidManifest.xml of the component com.aftership.AfterShip. The manipulation leads to improper expor…
-
Medium 5.3
1&1 Mail & Media mail.com App com.mail.mobile.android.mail AndroidManifest.xml improper export of android application components
A security vulnerability has been detected in 1&1 Mail & Media mail.com App 8.8.0 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.mail.mobile.android.mail. The manipulation leads to improper export of android a…