CWE-926
Improper Export of Android Application Components
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Mitigation
Phase: Build and Compilation
Strategy: Attack Surface Reduction
Description:
- If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.
Mitigation
Phase: Build and Compilation
Strategy: Attack Surface Reduction
Description:
- If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.
Mitigation
Phases: Build and Compilation, Architecture and Design
Strategy: Attack Surface Reduction
Description:
- Limit Content Provider permissions (read/write) as appropriate.
Mitigation
Phases: Build and Compilation, Architecture and Design
Strategy: Separation of Privilege
Description:
- Limit Content Provider permissions (read/write) as appropriate.
No CAPEC attack patterns related to this CWE.