Weaknesses of type CWE-926

119 results

Exportação Inadequada de Componentes Android

Um app Android declara Activities, Services, Broadcast Receivers ou Content Providers como exportáveis (via android:exported="true" ou implicitamente) sem proteção suficiente. Isso permite que outros apps no dispositivo acessem ou interajam com esses componentes, potencialmente roubando dados, modificando comportamento ou executando ações não autorizadas.

Example

Um app bancário expõe um Service que processa transações sem verificar quem o está chamando. Um malware no dispositivo descobre isso e invoca o Service para realizar transferências em nome do app legítimo.

How to mitigate

Declare android:exported="false" por padrão em AndroidManifest.xml; apenas exporte componentes que realmente precisam ser acessados por outros apps e, quando fizer, implemente verificação rigorosa de permissões e validação de Intent usando checkCallingPermission() ou verificação de assinatura do chamador.

CVE-2026-113385MEDIUMLeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application componentsEPSS 0.1%CVE-2026-20516MEDIUMIn MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with UsEPSS 0.1%CVE-2026-21108MEDIUMImproper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive inforEPSS 0.1%CVE-2026-21081MEDIUMImproper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitivEPSS 0.1%CVE-2021-25397MEDIUMAn improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of tEPSS 0.1%CVE-2026-21059MEDIUMImproper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file EPSS 0.1%CVE-2026-107036MEDIUMInsecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impaEPSS 0.1%CVE-2026-21113MEDIUMImproper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call wiEPSS 0.1%CVE-2026-54376HIGHVitaFit Android < 2.8.1.0 Custom URI Scheme Token HijackingEPSS 0.1%CVE-2026-21127MEDIUMImproper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive dEPSS 0.1%CVE-2023-44121MEDIUMLG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhereEPSS 0.1%CVE-2022-24929MEDIUMUnprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.EPSS 0.1%CVE-2023-44129LOWMessaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivityEPSS 0.1%CVE-2026-44279MEDIUMAn improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 allEPSS 0.1%CVE-2026-3291MEDIUMSamsung Print Service Plugin – Potential Information DisclosureEPSS 0.1%CVE-2021-25388HIGHImproper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.EPSS 0.1%CVE-2026-45528HIGHIn getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. ThisEPSS 0.1%CVE-2025-32347HIGHIn onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. TEPSS 0.1%CVE-2023-20962MEDIUMIn getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to EPSS 0.1%