Improper Export of Android Application Components
CWE-926
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
We track 11 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
How this weakness is prevented
- Build and Compilation: If they do not need to be shared by other applications, explicitly mark components with android:exported=false in the application manifest.
- Build and Compilation: If you only intend to use exported components between related apps under your control, use android:protectionLevel=signature in the xml manifest to restrict access to applications signed by you.
- Build and Compilation Architecture and Design: Limit Content Provider permissions (read/write) as appropriate.
- Build and Compilation Architecture and Design: Limit Content Provider permissions (read/write) as appropriate.
Latest Improper Export of Android Application Components vulnerabilities
- 7.1 High severity
Idea Tab Pro TB373FU: Improper Export of Android Application Components
A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write with elevated privileges.
- 8.2 High severity
VitaFit: Improper Export of Android Application Components
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can cap
- 8.6 High severity
Acode: Exposed Dangerous Method or Function
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src
- 8.5 High severity
File Manager: Improper Export of Android Application Components
Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File(.
- 7.1 High severity
File Manager Application: Improper Export of Android Application Components
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.
- 7.3 High severity
Android: Improper Export of Android Application Components
In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed
- 7.1 High severity
Samsung Mobile Devices: Improper Export of Android Application Components
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
- 7.1 High severity
core: Improper Export of Android Application Components
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a f
- 7.8 High severity
Android: Improper Export of Android Application Components
In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is need
- 8.5 High severity
com.bluebird.kiosk.launcher: Improper Export of Android Application Components
Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemoteService". A local attacker can bind to the AIDL-type service to modify device's global settings and
- 8.3 High severity
com.pri.applock: Improper Export of Android Application Components
An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.pri.applock.LockUI“ activity allows any other malicious application