CWE-926

Improper Export of Android Application Components

Medium

Description

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Potential Impact

How to Fix

Build and Compilation

If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.

Build and Compilation

If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.

Build and Compilation

Limit Content Provider permissions (read/write) as appropriate.

Build and Compilation

Limit Content Provider permissions (read/write) as appropriate.

Detection Methods

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-926 vulnerabilities in your codebase.

Get Security Assessment