Weaknesses of type CWE-926

98 results

Exportação Inadequada de Componentes Android

Um app Android declara Activities, Services, Broadcast Receivers ou Content Providers como exportáveis (via android:exported="true" ou implicitamente) sem proteção suficiente. Isso permite que outros apps no dispositivo acessem ou interajam com esses componentes, potencialmente roubando dados, modificando comportamento ou executando ações não autorizadas.

Example

Um app bancário expõe um Service que processa transações sem verificar quem o está chamando. Um malware no dispositivo descobre isso e invoca o Service para realizar transferências em nome do app legítimo.

How to mitigate

Declare android:exported="false" por padrão em AndroidManifest.xml; apenas exporte componentes que realmente precisam ser acessados por outros apps e, quando fizer, implemente verificação rigorosa de permissões e validação de Intent usando checkCallingPermission() ou verificação de assinatura do chamador.

CVE-2025-10718MEDIUMOoma Office Business Phone App com.ooma.office2 improper export of android application componentsEPSS 0.1%CVE-2025-10717MEDIUMintsig CamScanner App com.intsig.camscanner AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-7940MEDIUMGenshin Albedo Cat House App com.house.auscat AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2023-41822MEDIUM An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local applicatioEPSS 0.1%CVE-2026-3291MEDIUMSamsung Print Service Plugin – Potential Information DisclosureEPSS 0.1%CVE-2025-5344HIGHExposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk applicationEPSS 0.1%CVE-2025-5346MEDIUMFile removal via path traversal in unsecured broadcast receiver in Bluebird barcode scanner applicationEPSS 0.1%CVE-2026-44279MEDIUMAn improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 allEPSS 0.1%CVE-2026-86701LOWAndroid application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious appliEPSS 0.1%CVE-2023-41816MEDIUM An improper export vulnerability was reported in the Motorola Services Main application that could allow a local attacker to write to a locEPSS 0.1%CVE-2025-9097MEDIUMEuro Information CIC banque et compte en ligne App com.cic_prod.bad AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-9672MEDIUMRejseplanen App de.hafas.android.rejseplanen AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-9673MEDIUMKakao 헤이카카오 Hey Kakao App com.kakao.i.connect AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-9671MEDIUMUAB Paytend App com.passport.cash AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-5500MEDIUMZhenShi Mibro Fit App com.xiaoxun.xunoversea.mibrofit AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-10715MEDIUMAPEUni PTE Exam Practice App com.ape_edication AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-10195MEDIUMSeismic App com.seismic.doccenter AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-10722MEDIUMSKTLab Mukbee App com.dw.android.mukbee AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2026-20516MEDIUMIn MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with UsEPSS 0.1%CVE-2026-21081MEDIUMImproper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitivEPSS 0.1%