CWE-926 Improper Export of Android Application Components
variantThe Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (117)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2008-4728US | high9.3 | Exploit | ||
Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deployment Wizard 2008 allow remote attackers t… | ||||
| CVE-2008-4699US | high9.3 | Exploit | ||
Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers to execute arbitrary programs via the ExecutePreferredAppli… | ||||
| CVE-2008-1116US | high9.3 | Exploit | ||
Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner allows remote attackers to force the download and execution of… | ||||
| CVE-2008-7022US | high9.3 | Exploit | ||
Insecure method vulnerability in ChilkatMail_v7_9.dll in the Chilkat Software IMAP ActiveX control (ChilkatMail2.ChilkatMailMan2.1) allows remote attackers to execute arbitrary pro… | ||||
| CVE-2013-6724US | high9.3 | — | ||
Unspecified vulnerability in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 IF1 allows remote attackers to execute arbitrary code via a crafted ComboList pro… | ||||
| CVE-2009-0218US | high9.3 | — | ||
Insecure method vulnerability in Particle Software IntraLaunch Application Launcher ActiveX control in IntraLaunch.ocx, as used in LDRA TBbrowse and possibly other products, allows… | ||||
| CVE-2020-5604US | high8.1 | — | ||
Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java R… | ||||
| CVE-2005-2743US | high7.5 | — | ||
The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries, which allows remote attackers t… | ||||
| CVE-2021-25400US | high7.8 | — | ||
Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action. | ||||
| CVE-2020-0262US | high7.8 | — | ||
In WiFi tethering, there is a possible attacker controlled intent due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges ne… | ||||
| CVE-1999-0669US | medium4.0 | Exploit | ||
The Eyedog ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as demonstrated by Bubbleboy. | ||||
| CVE-2026-18994US | high7.1 | — | ||
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a loca… | ||||
| CVE-2026-21059US | high7.1 | — | ||
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | ||||
| CVE-2021-25388US | high7.1 | — | ||
Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app. | ||||
| CVE-2021-39080US | medium6.5 | — | ||
Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge… | ||||
| CVE-2023-44121US | medium6.3 | — | ||
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could… | ||||
| CVE-2026-21063US | medium6.1 | — | ||
Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function. | ||||
| CVE-2026-21113US | medium5.5 | — | ||
Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission. | ||||
| CVE-2026-21108US | medium5.5 | — | ||
Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information. | ||||
| CVE-2026-44279US | medium5.5 | — | ||
An improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 all versions, FortiTokenAndroid 5.2 all ver… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan