Falhas do tipo CWE-926

84 resultados

Exportação Inadequada de Componentes Android

Quando um app Android expõe Activities, Services, Broadcast Receivers ou Content Providers sem restringir o acesso, qualquer outro app no dispositivo consegue ativar e interagir com esses componentes. Isso permite que atacantes invoguem funcionalidades sensíveis, acessem dados privados ou sequestrem o fluxo de execução da aplicação.

Exemplo

Um app de banco define um Service para processar transferências sem o atributo android:exported="false" no AndroidManifest.xml. Um malware consegue enviar intents para esse Service e disparar transferências não autorizadas ou extrair dados da sessão do usuário.

Como mitigar

Marque android:exported="false" para todos os componentes que não precisam ser acessados por apps externos. Para componentes que precisam ser públicos, use permission-level em <permission> ou implemente validação de intent assinada com a chave privada do app para confirmar a origem da requisição.

CVE-2025-15464HIGHKL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context HijackingEPSS 0.5%CVE-2025-27599MEDIUMElement X Android vulnerable to loading malicious web pages via received intentEPSS 0.3%CVE-2025-7891MEDIUMInstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-68713HIGHAn issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allEPSS 0.3%CVE-2025-9135MEDIUMVerkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7890MEDIUMDunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7892MEDIUMIDnow App de.idnow AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7893MEDIUMForesight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9676MEDIUMNCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9677MEDIUMModo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9674MEDIUMTransbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9675MEDIUMVoice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2021-4438MEDIUMkyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application componentsEPSS 0.3%CVE-2025-9134MEDIUMAfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2024-36437MEDIUMThe com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (wiEPSS 0.3%CVE-2025-9093MEDIUMBuzzFeed App com.buzzfeed.android AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2023-21485MEDIUMImproper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows phEPSS 0.3%CVE-2023-21486MEDIUMImproper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows phEPSS 0.3%CVE-2021-25400—Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.EPSS 0.2%CVE-2025-7889MEDIUMCallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application componentsEPSS 0.2%