auditing-android-component-exposure

name	auditing-android-component-exposure
description	Audit an Android app for components another app on the device can reach and drive, after the manifest export flags and permission gates are resolved. Covers an activity, service, broadcast receiver, or content provider exported without a permission gate, an intent filter that makes a component implicitly exported, a provider that grants URI access or exposes files across the app boundary, a permission declared with a weak protection level, and a component that trusts intent extras from an untrusted caller for a sensitive action. Use when reviewing the manifest and the component code that handles an inbound intent, not the deep-link URL trust that a WebView loads (that is the deep-link skill). A cross-app caller is the source, a reachable exported component acting on the intent is the sink, and a sensitive component another app can invoke unguarded is the bug.
license	MIT

Auditing Android component exposure: what another app on the device can reach and drive

An Android component is only an attack surface if another app can reach it, so this audit is a resolution of the export state and the permission gate, not a scan of component names. A component is exported when a flag says so or an intent filter makes it so by default, and it is exposed only when no permission of a strong enough protection level gates the caller. The bug is a sensitive component another installed app can invoke, and then trust the caller's intent extras to do something it should not. You audit it by resolving, per component, whether it is reachable across the app boundary and what it does with an attacker's intent. Stay on component reachability and inbound-intent handling; when the exposure is a URL the component hands to a WebView, that is the deep-link skill's seam, cross-referenced below.

When to use

• You are reviewing an Android manifest and the activities, services, receivers, or providers it declares.