Exported components and intent safety

Security Mid-level Kotlin 2.0+ API 33+ Reviewed By Best Latest Apps

Spot the bug

This exported Activity has a serious bug. Which line?

  1. class ShareActivity : android.app.Activity() {
  2. override fun onCreate(savedInstanceState: android.os.Bundle?) {
  3. super.onCreate(savedInstanceState)
  4. val next = intent.getParcelableExtra("next", android.content.Intent::class.java)
  5. if (next != null) startActivity(next)
  6. finish()
  7. }
  8. }
Hint 1 of 1

Who controls the extras of an exported Activity?

Choose an answer, then open Show answer below to check it.

Show answer
  • Answer: line 5 if (next != null) startActivity(next)

Line 5 launches an intent supplied by another app with this app's identity. An attacker could use it to open your private, non-exported Activities. Validate the target or don't forward intents at all.

30-second answer

An exported Activity, Service, receiver or provider can be started by any app. Since Android 12, components with intent filters must declare android:exported explicitly. Export only what must be public, protect the rest with exported="false" or a signature permission, validate every extra from incoming intents, and never forward an untrusted intent (intent redirection).

Practise saying it · 30 s. No recording, just a timer

Explain exported component safety.

Say your answer out loud, then check which of these points you covered:

  • Explicit exported flag
  • Export only what's needed
  • Validate extras
  • No intent redirection

Deep dive

Use explicit intents for your own components.

PendingIntent.FLAG_IMMUTABLE stops other apps changing your intents.

Content providers need grantUriPermissions instead of being fully exported.

Deep link Activities are public by design, so treat their input as untrusted.

Common mistakes

  • Exporting internal Activities 'just in case'.
  • Trusting extras like isAdmin=true from an intent.
  • Launching an intent passed inside another intent's extras.

Senior take & follow-ups

List the rules, then explain intent redirection as the classic bug.

Follow-up questions

Think of your answer first, then open the hint.

  1. What's intent redirection?

    Show hint

    An attacker passes an intent your app launches with its own permissions.

  2. What's a signature permission?

    Show hint

    Only apps signed with the same key can use the component.

Related questions

Free tool

Deep link tester

Free tool: build the adb and intent:// commands for any link and check an intent filter before you ship it.

Open the tool

Suggest a fix if something here is wrong or out of date.