Weaknesses of type CWE-926

98 results

Exportação Inadequada de Componentes Android

Um app Android declara Activities, Services, Broadcast Receivers ou Content Providers como exportáveis (via android:exported="true" ou implicitamente) sem proteção suficiente. Isso permite que outros apps no dispositivo acessem ou interajam com esses componentes, potencialmente roubando dados, modificando comportamento ou executando ações não autorizadas.

Example

Um app bancário expõe um Service que processa transações sem verificar quem o está chamando. Um malware no dispositivo descobre isso e invoca o Service para realizar transferências em nome do app legítimo.

How to mitigate

Declare android:exported="false" por padrão em AndroidManifest.xml; apenas exporte componentes que realmente precisam ser acessados por outros apps e, quando fizer, implemente verificação rigorosa de permissões e validação de Intent usando checkCallingPermission() ou verificação de assinatura do chamador.

CVE-2026-44965MEDIUMIn versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorEPSS 0.1%CVE-2026-21108MEDIUMImproper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive inforEPSS 0.1%CVE-2026-18604MEDIUMtextPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application componentsEPSS 0.1%CVE-2023-44121MEDIUMLG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhereEPSS 0.1%CVE-2022-24929MEDIUMUnprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.EPSS 0.1%CVE-2026-18994HIGHA potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in theEPSS 0.1%CVE-2026-44279MEDIUMAn improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 allEPSS 0.1%CVE-2026-86701LOWAndroid application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious appliEPSS 0.1%CVE-2026-3291MEDIUMSamsung Print Service Plugin – Potential Information DisclosureEPSS 0.1%CVE-2023-44129LOWMessaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivityEPSS 0.1%CVE-2026-20516MEDIUMIn MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with UsEPSS 0.1%CVE-2026-21059MEDIUMImproper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file EPSS 0.1%CVE-2026-21113MEDIUMImproper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call wiEPSS 0.1%CVE-2026-21081MEDIUMImproper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitivEPSS 0.1%CVE-2021-25388HIGHImproper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.EPSS 0.1%CVE-2023-20962MEDIUMIn getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to EPSS 0.1%CVE-2025-32347HIGHIn onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. TEPSS 0.1%CVE-2026-45528HIGHIn getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. ThisEPSS 0.1%