cve.bz

CWE-926: Improper Export of Android Application Components

Filter

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

What the weakness is: CWE-926 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

Ask an AI about CWE-926

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-926: Improper Export of Android Application Components and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/926.html and https://cve.bz/cve/cwe/926?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.2CVE-2026-54376

    VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.c…

  2. 7.5CVE-2026-107059EPSS 0.3%

    An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.

  3. 9.8CVE-2026-107057EPSS 0.4%

    An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.

  4. 7.5CVE-2026-107051EPSS 0.2%

    Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.

  5. 9.8CVE-2026-107048EPSS 0.5%

    An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

  6. 5.3CVE-2026-107046EPSS 0.3%

    A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.

  7. 9.1CVE-2026-107043EPSS 0.3%

    Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

  8. 7.5CVE-2026-107041EPSS 0.4%

    Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).

  9. 9.1CVE-2026-107040EPSS 0.3%

    Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

  10. 9.1CVE-2026-107038EPSS 0.4%

    Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

  11. 5.1CVE-2026-107036EPSS 0.1%

    Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.

  12. 6.5CVE-2026-107033EPSS 0.2%

    Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.

  13. 9.1CVE-2026-107032EPSS 0.5%

    Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

  14. 7.5CVE-2026-107030EPSS 0.3%

    Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing.

  15. 9.1CVE-2026-107027EPSS 0.3%

    Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.

  16. 7.5CVE-2026-107025EPSS 0.3%

    Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.

  17. 9.1CVE-2026-107021EPSS 0.3%

    Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

  18. 8.8CVE-2026-107019EPSS 0.3%

    Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.

  19. 9.1CVE-2026-107014EPSS 0.3%

    Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.

  20. 1.9CVE-2026-113385EPSS 0.1%

    A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android a…

  21. 6.9CVE-2026-21127EPSS 0.1%

    Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

  22. 8.6CVE-2026-68928EPSS 0.2%

    Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src…

  23. 1.8CVE-2026-86701EPSS 0.1%

    Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, pot…

  24. 8.5CVE-2026-81301EPSS 0.2%

    Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and p…

  25. 8.4CVE-2026-18994EPSS 0.1%

    A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files with…

  26. 4.8CVE-2026-21113EPSS 0.1%

    Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission.

  27. 6.9CVE-2026-21108EPSS 0.1%

    Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information.

  28. 7.3CVE-2026-45528EPSS 0.09%

    In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User i…

  29. 5.5CVE-2026-20516EPSS 0.1%

    In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS1106…

  30. 5.1CVE-2026-21081EPSS 0.1%

    Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.

  31. 6.8CVE-2026-21063EPSS 0.2%

    Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function.

  32. 6.9CVE-2026-21059EPSS 0.1%

    Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.

  33. 6.3CVE-2026-47363EPSS 0.3%

    In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app int…

  34. 6.4CVE-2026-47361EPSS 0.3%

    In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process sessio…

  35. 5.5CVE-2026-44965EPSS 0.2%

    In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, …

  36. 1.9CVE-2026-18604EPSS 0.1%

    A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application co…

  37. 6.2CVE-2026-20470EPSS 0.2%

    In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Pa…

  38. 6.8CVE-2026-57848EPSS 0.2%

    Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent…

  39. 6.0CVE-2026-12960EPSS 0.2%

    An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Securit…

  40. 7.1CVE-2026-54318EPSS 0.2%

    Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissio…

  41. 8.0CVE-2025-68713EPSS 0.3%

    An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's s…

  42. 5.5CVE-2026-44279EPSS 0.10%

    An improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 all versions, FortiTokenAndroid 5.2 all versions may allow attacker to disclose information via an exp…

  43. 6.9CVE-2026-3291EPSS 0.10%

    Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.

  44. 7.5CVE-2025-15464EPSS 0.5%

    Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls.

  45. 1.9CVE-2025-14517EPSS 0.2%

    A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity  of the file AndroidManifest.xml. Executing manipulation can lead to improper export of android application components. The attack can only be…

  46. 1.9CVE-2025-10722EPSS 0.1%

    A vulnerability was detected in SKTLab Mukbee App 1.01.196 on Android. This affects an unknown function of the file AndroidManifest.xml of the component com.dw.android.mukbee. The manipulation results in improper export of android applicat…

  47. 1.9CVE-2025-10721EPSS 0.1%

    A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml. This manipulation causes improper export of android application components. The…

  48. 1.9CVE-2025-10718EPSS 0.1%

    A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack n…

  49. 1.9CVE-2025-10717EPSS 0.1%

    A vulnerability has been found in intsig CamScanner App 6.91.1.5.250711 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.intsig.camscanner. The manipulation leads to impr…

  50. 1.9CVE-2025-10716EPSS 0.1%

    A flaw has been found in Creality Cloud App up to 6.1.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.cxsw.sdprinter. Executing manipulation can lead to improper…