Falhas do tipo CWE-926

119 resultados

Exportação Inadequada de Componentes Android

Quando um app Android expõe Activities, Services, Broadcast Receivers ou Content Providers sem restringir o acesso, qualquer outro app no dispositivo consegue ativar e interagir com esses componentes. Isso permite que atacantes invoguem funcionalidades sensíveis, acessem dados privados ou sequestrem o fluxo de execução da aplicação.

Exemplo

Um app de banco define um Service para processar transferências sem o atributo android:exported="false" no AndroidManifest.xml. Um malware consegue enviar intents para esse Service e disparar transferências não autorizadas ou extrair dados da sessão do usuário.

Como mitigar

Marque android:exported="false" para todos os componentes que não precisam ser acessados por apps externos. Para componentes que precisam ser públicos, use permission-level em <permission> ou implemente validação de intent assinada com a chave privada do app para confirmar a origem da requisição.

CVE-2026-47361MEDIUMIn versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEEPSS 0.3%CVE-2025-9676MEDIUMNCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9674MEDIUMTransbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9677MEDIUMModo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9675MEDIUMVoice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-68713HIGHAn issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allEPSS 0.3%CVE-2026-107046MEDIUMA Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan interEPSS 0.3%CVE-2025-7889MEDIUMCallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9134MEDIUMAfterShip Package Tracker App com.aftership.AfterShip AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9135MEDIUMVerkehrsauskunft Österreich SmartRide/cleVVVer/BusBahnBim/Salzburg Verkehr AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-9093MEDIUMBuzzFeed App com.buzzfeed.android AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-8210MEDIUMYeelink Yeelight App com.yeelight.cherry AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-8207MEDIUMCanara ai1 Mobile Banking App com.canarabank.mobility AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2026-47363MEDIUMIn versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied EPSS 0.3%CVE-2021-4438MEDIUMkyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application componentsEPSS 0.3%CVE-2024-36437MEDIUMThe com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (wiEPSS 0.3%CVE-2025-8258MEDIUMCool Mo Maigcal Number App com.sdmagic.number AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-8257MEDIUMLobby Universe Lobby App com.maverick.lobby AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2023-21485MEDIUMImproper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows phEPSS 0.3%CVE-2023-21486MEDIUMImproper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows phEPSS 0.3%