Falhas do tipo CWE-926

119 resultados

Exportação Inadequada de Componentes Android

Quando um app Android expõe Activities, Services, Broadcast Receivers ou Content Providers sem restringir o acesso, qualquer outro app no dispositivo consegue ativar e interagir com esses componentes. Isso permite que atacantes invoguem funcionalidades sensíveis, acessem dados privados ou sequestrem o fluxo de execução da aplicação.

Exemplo

Um app de banco define um Service para processar transferências sem o atributo android:exported="false" no AndroidManifest.xml. Um malware consegue enviar intents para esse Service e disparar transferências não autorizadas ou extrair dados da sessão do usuário.

Como mitigar

Marque android:exported="false" para todos os componentes que não precisam ser acessados por apps externos. Para componentes que precisam ser públicos, use permission-level em <permission> ou implemente validação de intent assinada com a chave privada do app para confirmar a origem da requisição.

CVE-2025-9098MEDIUMElseplus File Recovery App AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2026-20470MEDIUMIn Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure EPSS 0.2%CVE-2026-54318HIGHHome Assistant: Exported BroadcastReceiver allows local apps to spoof device locationEPSS 0.2%CVE-2024-6051MEDIUMCross Application Scripting in Redlink SDKEPSS 0.2%CVE-2021-25391MEDIUMIntent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.EPSS 0.2%CVE-2023-41827MEDIUMAn improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to injEPSS 0.2%CVE-2026-81301HIGHEkia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file accessEPSS 0.2%CVE-2026-44965MEDIUMIn versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorEPSS 0.2%CVE-2025-7940MEDIUMGenshin Albedo Cat House App com.house.auscat AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2026-12960MEDIUMAn Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device toEPSS 0.2%CVE-2025-5344HIGHExposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk applicationEPSS 0.2%CVE-2023-41823MEDIUM An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unaEPSS 0.2%CVE-2021-25390MEDIUMIntent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.EPSS 0.2%CVE-2025-5346MEDIUMFile removal via path traversal in unsecured broadcast receiver in Bluebird barcode scanner applicationEPSS 0.2%CVE-2025-8523MEDIUMRiderLike Fruit Crush-Brain App com.fruitcrush.fun AndroidManifest.xml improper export of android application componentsEPSS 0.2%CVE-2023-41829MEDIUMAn improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application tEPSS 0.2%CVE-2025-20934MEDIUMImproper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilegeEPSS 0.2%CVE-2025-8524MEDIUMBoquan DotWallet App com.boquanhash.dotwallet AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-8513MEDIUMCaixin News App com.caixin.news AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2023-41821MEDIUM A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user EPSS 0.1%