Falhas do tipo CWE-926

98 resultados

Exportação Inadequada de Componentes Android

Quando um app Android expõe Activities, Services, Broadcast Receivers ou Content Providers sem restringir o acesso, qualquer outro app no dispositivo consegue ativar e interagir com esses componentes. Isso permite que atacantes invoguem funcionalidades sensíveis, acessem dados privados ou sequestrem o fluxo de execução da aplicação.

Exemplo

Um app de banco define um Service para processar transferências sem o atributo android:exported="false" no AndroidManifest.xml. Um malware consegue enviar intents para esse Service e disparar transferências não autorizadas ou extrair dados da sessão do usuário.

Como mitigar

Marque android:exported="false" para todos os componentes que não precisam ser acessados por apps externos. Para componentes que precisam ser públicos, use permission-level em <permission> ou implemente validação de intent assinada com a chave privada do app para confirmar a origem da requisição.

CVE-2026-54318HIGHHome Assistant: Exported BroadcastReceiver allows local apps to spoof device locationEPSS 0.2%CVE-2024-6051MEDIUMCross Application Scripting in Redlink SDKEPSS 0.2%CVE-2023-41827MEDIUMAn improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to injEPSS 0.2%CVE-2021-25391MEDIUMIntent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.EPSS 0.2%CVE-2026-12960MEDIUMAn Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device toEPSS 0.2%CVE-2021-25390MEDIUMIntent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.EPSS 0.2%CVE-2023-41823MEDIUM An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unaEPSS 0.2%CVE-2023-41829MEDIUMAn improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application tEPSS 0.2%CVE-2023-41821MEDIUM A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user EPSS 0.1%CVE-2025-20934MEDIUMImproper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilegeEPSS 0.1%CVE-2026-21063MEDIUMImproper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock fuEPSS 0.1%CVE-2025-10721MEDIUMWebull Investing & Trading App AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2024-3479LOW An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProviderEPSS 0.1%CVE-2025-10716MEDIUMCreality Cloud App com.cxsw.sdprinter AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-10717MEDIUMintsig CamScanner App com.intsig.camscanner AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2026-47363MEDIUMIn versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied EPSS 0.1%CVE-2025-10718MEDIUMOoma Office Business Phone App com.ooma.office2 improper export of android application componentsEPSS 0.1%CVE-2025-7940MEDIUMGenshin Albedo Cat House App com.house.auscat AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2023-41822MEDIUM An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local applicatioEPSS 0.1%CVE-2025-5344HIGHExposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk applicationEPSS 0.1%