CWE-925: Improper Verification of Intent by Broadcast Receiver
Filter
The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
What the weakness is: CWE-925 at MITRE. All weaknesses
Related attack patterns (CAPEC): 1
- CAPEC-499 Android Intent Intercept
The attack patterns MITRE's CAPEC relates to CWE-925, as MITRE names them. Credits.
Ask an AI about CWE-925
Show the prompt
Explain CWE-925: Improper Verification of Intent by Broadcast Receiver and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/925.html and https://cve.bz/cve/cwe/925?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.1CVE-2026-21106EPSS 0.2%
Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings.
- 5.3CVE-2026-33173EPSS 0.4%
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because i…
- 9.4CVE-2024-10576EPSS 0.2%
Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and force the device to perform a factory reset without any Android…
- 5.5CVE-2023-44126EPSS 0.1%
The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents inc…