Skip to content
OpenAdvisories

Weakness (CWE)

CWE-926: Improper Export of Android Application Components

Variant Incomplete

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

How to prevent it (4 mitigations)

  1. Build and Compilation

    If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.

  2. Build and Compilation

    If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.

  3. Build and Compilation, Architecture and Design

    Limit Content Provider permissions (read/write) as appropriate.

  4. Build and Compilation, Architecture and Design

    Limit Content Provider permissions (read/write) as appropriate.

Source: MITRE CWE-926

All Critical High Medium Low Exploited only Public exploit

85 results · Clear filters · Feed