Android Components Security

Android applications contain components such as activities, services,
broadcast receivers, and content providers. Components that are
accessible from outside the application can create an attack surface.

Exported Activities:
An exported activity can potentially be launched by another application.
An exported activity is not automatically a vulnerability. The security
impact depends on whether the activity exposes sensitive functionality
or accepts untrusted input.

Exported Services:
An exported service can potentially be started or bound to by another
application. Services performing sensitive operations should use
appropriate permission protection and validate external input.

Exported Broadcast Receivers:
An exported broadcast receiver may receive broadcasts originating outside
the application. Sensitive receivers should be protected with appropriate
permissions and should validate incoming intents and extras.

Exported Content Providers:
Exported content providers may expose application data through queries,
inserts, updates, or deletes. Providers handling sensitive data should
use appropriate access controls and validate requested operations.

Unprotected Exported Components:
An exported component that performs sensitive operations without suitable
permission protection may allow other applications to invoke functionality
that should remain private.

Component Permissions:
Android components can use permissions to restrict access. An exported
component without permission protection should be reviewed, particularly
when it performs security-sensitive operations.

Intent Input:
Components receiving external intents should validate action names,
extras, URIs, and other input. Trusting attacker-controlled intent data
can lead to insecure behavior.

Component Security Assessment:
The existence of an exported component does not automatically prove a
vulnerability. The component's functionality, exported state, permission
requirements, input validation, and accessible resources should be
considered.

Static Evidence:
Static analysis can identify exported components and whether they appear
to be protected.

Dynamic Evidence:
Successful external launching, binding, broadcasting, or querying of an
exported component provides stronger evidence that the component is
actually externally accessible.

Important:
A component should be considered affected only when there is evidence
connecting it to a security finding. Do not mark every exported component
as vulnerable.