Weaknesses of type CWE-926

98 results

Exportação Inadequada de Componentes Android

Um app Android declara Activities, Services, Broadcast Receivers ou Content Providers como exportáveis (via android:exported="true" ou implicitamente) sem proteção suficiente. Isso permite que outros apps no dispositivo acessem ou interajam com esses componentes, potencialmente roubando dados, modificando comportamento ou executando ações não autorizadas.

Example

Um app bancário expõe um Service que processa transações sem verificar quem o está chamando. Um malware no dispositivo descobre isso e invoca o Service para realizar transferências em nome do app legítimo.

How to mitigate

Declare android:exported="false" por padrão em AndroidManifest.xml; apenas exporte componentes que realmente precisam ser acessados por outros apps e, quando fizer, implemente verificação rigorosa de permissões e validação de Intent usando checkCallingPermission() ou verificação de assinatura do chamador.

CVE-2021-25400—Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.EPSS 0.2%CVE-2025-8745MEDIUMWeee RICEPO App com.ricepo.app AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2025-9102MEDIUM1&1 Mail & Media mail.com App com.mail.mobile.android.mail AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2021-25527LOWImproper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to accesEPSS 0.2%CVE-2025-8210MEDIUMYeelink Yeelight App com.yeelight.cherry AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2025-8207MEDIUMCanara ai1 Mobile Banking App com.canarabank.mobility AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2025-9695MEDIUMGalleryVault Gallery Vault App com.thinkyeah.galleryvault AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2025-8707MEDIUMHuuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2021-25379MEDIUMIntent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.EPSS 0.2%CVE-2025-8257MEDIUMLobby Universe Lobby App com.maverick.lobby AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2025-8258MEDIUMCool Mo Maigcal Number App com.sdmagic.number AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2026-57848MEDIUMStoat for Android Internal File Disclosure via Exported ShareTargetActivity URI ValidationEPSS 0.2%CVE-2021-25526MEDIUMIntent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action.EPSS 0.2%CVE-2024-13917HIGHIntent Injection in Kruger&Matz AppLock applicationEPSS 0.2%CVE-2024-13915MEDIUMUnrestricted Access to Exported Service in com.pri.factorytestEPSS 0.2%CVE-2024-27086LOWMSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of serviceEPSS 0.2%CVE-2023-41960HIGHThe vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the AndrEPSS 0.2%CVE-2024-13916MEDIUMExposure of Applications' Encryption PINs in Kruger&Matz AppLockEPSS 0.2%CVE-2026-47361MEDIUMIn versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEEPSS 0.2%CVE-2025-9098MEDIUMElseplus File Recovery App AndroidManifest.xml improper export of android application componentsEPSS 0.2%