Weaknesses of type CWE-926

98 results

Exportação Inadequada de Componentes Android

Um app Android declara Activities, Services, Broadcast Receivers ou Content Providers como exportáveis (via android:exported="true" ou implicitamente) sem proteção suficiente. Isso permite que outros apps no dispositivo acessem ou interajam com esses componentes, potencialmente roubando dados, modificando comportamento ou executando ações não autorizadas.

Example

Um app bancário expõe um Service que processa transações sem verificar quem o está chamando. Um malware no dispositivo descobre isso e invoca o Service para realizar transferências em nome do app legítimo.

How to mitigate

Declare android:exported="false" por padrão em AndroidManifest.xml; apenas exporte componentes que realmente precisam ser acessados por outros apps e, quando fizer, implemente verificação rigorosa de permissões e validação de Intent usando checkCallingPermission() ou verificação de assinatura do chamador.

CVE-2026-54318HIGHHome Assistant: Exported BroadcastReceiver allows local apps to spoof device locationEPSS 0.2%CVE-2024-6051MEDIUMCross Application Scripting in Redlink SDKEPSS 0.2%CVE-2023-41827MEDIUMAn improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to injEPSS 0.2%CVE-2021-25391MEDIUMIntent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.EPSS 0.2%CVE-2026-12960MEDIUMAn Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device toEPSS 0.2%CVE-2023-41823MEDIUM An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unaEPSS 0.2%CVE-2021-25390MEDIUMIntent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.EPSS 0.2%CVE-2023-41829MEDIUMAn improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application tEPSS 0.2%CVE-2023-41821MEDIUM A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user EPSS 0.1%CVE-2025-20934MEDIUMImproper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilegeEPSS 0.1%CVE-2026-21063MEDIUMImproper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock fuEPSS 0.1%CVE-2025-10721MEDIUMWebull Investing & Trading App AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2024-3479LOW An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProviderEPSS 0.1%CVE-2025-10716MEDIUMCreality Cloud App com.cxsw.sdprinter AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-10717MEDIUMintsig CamScanner App com.intsig.camscanner AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2026-47363MEDIUMIn versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied EPSS 0.1%CVE-2025-10718MEDIUMOoma Office Business Phone App com.ooma.office2 improper export of android application componentsEPSS 0.1%CVE-2025-7940MEDIUMGenshin Albedo Cat House App com.house.auscat AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2023-41822MEDIUM An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local applicatioEPSS 0.1%CVE-2025-5344HIGHExposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk applicationEPSS 0.1%