Falhas do tipo CWE-926

98 resultados

Exportação Inadequada de Componentes Android

Quando um app Android expõe Activities, Services, Broadcast Receivers ou Content Providers sem restringir o acesso, qualquer outro app no dispositivo consegue ativar e interagir com esses componentes. Isso permite que atacantes invoguem funcionalidades sensíveis, acessem dados privados ou sequestrem o fluxo de execução da aplicação.

Exemplo

Um app de banco define um Service para processar transferências sem o atributo android:exported="false" no AndroidManifest.xml. Um malware consegue enviar intents para esse Service e disparar transferências não autorizadas ou extrair dados da sessão do usuário.

Como mitigar

Marque android:exported="false" para todos os componentes que não precisam ser acessados por apps externos. Para componentes que precisam ser públicos, use permission-level em <permission> ou implemente validação de intent assinada com a chave privada do app para confirmar a origem da requisição.

CVE-2026-44965MEDIUMIn versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorEPSS 0.1%CVE-2026-21108MEDIUMImproper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive inforEPSS 0.1%CVE-2026-18604MEDIUMtextPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application componentsEPSS 0.1%CVE-2023-44121MEDIUMLG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhereEPSS 0.1%CVE-2022-24929MEDIUMUnprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.EPSS 0.1%CVE-2026-18994HIGHA potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in theEPSS 0.1%CVE-2026-44279MEDIUMAn improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 allEPSS 0.1%CVE-2026-86701LOWAndroid application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious appliEPSS 0.1%CVE-2026-3291MEDIUMSamsung Print Service Plugin – Potential Information DisclosureEPSS 0.1%CVE-2023-44129LOWMessaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivityEPSS 0.1%CVE-2026-20516MEDIUMIn MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with UsEPSS 0.1%CVE-2026-21059MEDIUMImproper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file EPSS 0.1%CVE-2026-21113MEDIUMImproper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call wiEPSS 0.1%CVE-2026-21081MEDIUMImproper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitivEPSS 0.1%CVE-2021-25388HIGHImproper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.EPSS 0.1%CVE-2023-20962MEDIUMIn getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to EPSS 0.1%CVE-2025-32347HIGHIn onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. TEPSS 0.1%CVE-2026-45528HIGHIn getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. ThisEPSS 0.1%