Weaknesses of type CWE-926

87 results

Exportação Inadequada de Componentes Android

Um app Android declara Activities, Services, Broadcast Receivers ou Content Providers como exportáveis (via android:exported="true" ou implicitamente) sem proteção suficiente. Isso permite que outros apps no dispositivo acessem ou interajam com esses componentes, potencialmente roubando dados, modificando comportamento ou executando ações não autorizadas.

Example

Um app bancário expõe um Service que processa transações sem verificar quem o está chamando. Um malware no dispositivo descobre isso e invoca o Service para realizar transferências em nome do app legítimo.

How to mitigate

Declare android:exported="false" por padrão em AndroidManifest.xml; apenas exporte componentes que realmente precisam ser acessados por outros apps e, quando fizer, implemente verificação rigorosa de permissões e validação de Intent usando checkCallingPermission() ou verificação de assinatura do chamador.

CVE-2025-15464HIGHKL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context HijackingEPSS 0.5%CVE-2025-27599MEDIUMElement X Android vulnerable to loading malicious web pages via received intentEPSS 0.3%CVE-2025-7891MEDIUMInstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-68713HIGHAn issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allEPSS 0.3%CVE-2025-9135MEDIUMVerkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7890MEDIUMDunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7892MEDIUMIDnow App de.idnow AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7893MEDIUMForesight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9676MEDIUMNCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9677MEDIUMModo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9674MEDIUMTransbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9675MEDIUMVoice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2021-4438MEDIUMkyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application componentsEPSS 0.3%CVE-2025-9134MEDIUMAfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2024-36437MEDIUMThe com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (wiEPSS 0.3%CVE-2025-9093MEDIUMBuzzFeed App com.buzzfeed.android AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2023-21485MEDIUMImproper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows phEPSS 0.3%CVE-2023-21486MEDIUMImproper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows phEPSS 0.3%CVE-2025-14517MEDIUMYalantis uCrop AndroidManifest.xml UCropActivity  improper export of android application componentsEPSS 0.2%CVE-2021-25400—Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.EPSS 0.2%