Weaknesses of type CWE-926

119 results

Exportação Inadequada de Componentes Android

Um app Android declara Activities, Services, Broadcast Receivers ou Content Providers como exportáveis (via android:exported="true" ou implicitamente) sem proteção suficiente. Isso permite que outros apps no dispositivo acessem ou interajam com esses componentes, potencialmente roubando dados, modificando comportamento ou executando ações não autorizadas.

Example

Um app bancário expõe um Service que processa transações sem verificar quem o está chamando. Um malware no dispositivo descobre isso e invoca o Service para realizar transferências em nome do app legítimo.

How to mitigate

Declare android:exported="false" por padrão em AndroidManifest.xml; apenas exporte componentes que realmente precisam ser acessados por outros apps e, quando fizer, implemente verificação rigorosa de permissões e validação de Intent usando checkCallingPermission() ou verificação de assinatura do chamador.

CVE-2026-107048CRITICALAn issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via EPSS 0.5%CVE-2025-15464HIGHKL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context HijackingEPSS 0.5%CVE-2026-107032CRITICALInsecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, lEPSS 0.5%CVE-2026-107041HIGHInsecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarEPSS 0.4%CVE-2026-107057CRITICALAn issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.EPSS 0.4%CVE-2025-7891MEDIUMInstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application componentsEPSS 0.4%CVE-2025-27599MEDIUMElement X Android vulnerable to loading malicious web pages via received intentEPSS 0.4%CVE-2026-107038CRITICALInsecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leadingEPSS 0.4%CVE-2025-7890MEDIUMDunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7892MEDIUMIDnow App de.idnow AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7893MEDIUMForesight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2026-107021CRITICALInsecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackerEPSS 0.3%CVE-2026-107030HIGHInsecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (OEPSS 0.3%CVE-2026-107027CRITICALInsecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading EPSS 0.3%CVE-2026-107040CRITICALInsecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitraEPSS 0.3%CVE-2026-107059HIGHAn issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker contEPSS 0.3%CVE-2026-107019HIGHInsecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to creEPSS 0.3%CVE-2026-107025HIGHInsecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's datEPSS 0.3%CVE-2026-107014CRITICALInsecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user'EPSS 0.3%CVE-2026-107043CRITICALInsecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechaEPSS 0.3%