The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.
If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.
Limit Content Provider permissions (read/write) as appropriate.
Limit Content Provider permissions (read/write) as appropriate.
Our security experts can help you identify and remediate CWE-926 vulnerabilities in your codebase.
Get Security Assessment