Weaknesses of type CWE-926

119 results

Exportação Inadequada de Componentes Android

Um app Android declara Activities, Services, Broadcast Receivers ou Content Providers como exportáveis (via android:exported="true" ou implicitamente) sem proteção suficiente. Isso permite que outros apps no dispositivo acessem ou interajam com esses componentes, potencialmente roubando dados, modificando comportamento ou executando ações não autorizadas.

Example

Um app bancário expõe um Service que processa transações sem verificar quem o está chamando. Um malware no dispositivo descobre isso e invoca o Service para realizar transferências em nome do app legítimo.

How to mitigate

Declare android:exported="false" por padrão em AndroidManifest.xml; apenas exporte componentes que realmente precisam ser acessados por outros apps e, quando fizer, implemente verificação rigorosa de permissões e validação de Intent usando checkCallingPermission() ou verificação de assinatura do chamador.

CVE-2025-9093MEDIUMBuzzFeed App com.buzzfeed.android AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2026-47361MEDIUMIn versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEEPSS 0.3%CVE-2025-9676MEDIUMNCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9677MEDIUMModo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9674MEDIUMTransbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9675MEDIUMVoice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-68713HIGHAn issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allEPSS 0.3%CVE-2026-107046MEDIUMA Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan interEPSS 0.3%CVE-2025-9134MEDIUMAfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9135MEDIUMVerkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7889MEDIUMCallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-8207MEDIUMCanara ai1 Mobile Banking App com.canarabank.mobility AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-8210MEDIUMYeelink Yeelight App com.yeelight.cherry AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2026-47363MEDIUMIn versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied EPSS 0.3%CVE-2021-4438MEDIUMkyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application componentsEPSS 0.3%CVE-2024-36437MEDIUMThe com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (wiEPSS 0.3%CVE-2025-8258MEDIUMCool Mo Maigcal Number App com.sdmagic.number AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2023-21485MEDIUMImproper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows phEPSS 0.3%CVE-2023-21486MEDIUMImproper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows phEPSS 0.3%CVE-2025-8257MEDIUMLobby Universe Lobby App com.maverick.lobby AndroidManifest.xml improper export of android application componentsEPSS 0.3%