# Exported component trusts intent extras

Exported Android components acting on unvalidated intent extras meant for internal callers

_Area: Mobile app security. Seen in 5 disclosed reports; 3 confirmed bounties, median $300, range $100-$4,000; latest 2026-09-28. Updated 2026-10-23._

## How it works
An Android component is exported, so any installed app can send it an intent, but its code assumes the caller is internal: a sibling activity, an in-process AIDL service, or the system. It reads intent extras — destination URIs, file paths, flags like `silent_import` or `replace` — and acts on them without checking who sent the intent. Android cannot restrict which extras an external app sets, so the assumption "only our code sends this" is false. The exported component becomes a confused deputy: the attacker supplies the data, the privileged component performs the action [E1](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-blog-launching-internal-non-exported-deeplinks-on-facebook.md)[E3](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent.md).

## Where it shows up
- `android:exported="true"` on activities/services/receivers that parse `getIntent().getExtras()` or `getStringExtra(...)`.
- Extras controlling navigation or deeplink URIs (`rum_destination_uri`, tile/route URL templates) [E1](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-blog-launching-internal-non-exported-deeplinks-on-facebook.md)[E3](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent.md).
- Extras controlling file paths, content URIs, or package names passed to privileged APIs [E2](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-1.md).
- Boolean/flag extras (`silent_import`, `replace`, `should_show_rum_player`) that skip confirmation UI [E1](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-blog-launching-internal-non-exported-deeplinks-on-facebook.md)[E3](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent.md).
- OEM-modified AOSP components where an authorization check (e.g. `verifyActionAndCaller`) is skipped by an extra like `requestId` [E2](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-1.md).

## How to review
For every exported component, trace each extra from `getIntent` to its sink (deeplink dispatch, file I/O, package install, URL config). The invariant: no security-relevant action may depend on an extra unless the caller is verified (signature permission, `checkCallingPermission`, caller UID/package check) or the value is validated against an allowlist. Confirm the component is genuinely exported and reachable. Diff OEM code against upstream to spot removed checks [E2](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-1.md).

## Variants seen
- Navigation/destination URI extra bypassing deeplink restrictions [E1](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-blog-launching-internal-non-exported-deeplinks-on-facebook.md).
- Settings-import extras rewriting URL templates to leak location [E3](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent.md).
- Exported services/receivers accepting URIs and file paths with no caller verification [E2](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-1.md).
- OEM check bypassed by an extra that skips the authorization routine [E2](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-1.md).

## Impact and severity
High: launching internal non-exported deeplinks [E1](https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-blog-launching-internal-non-exported-deeplinks-on-facebook.md); arbitrary app install, Device Admin grant, system-UID file read/write [E2](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-1.md); precise location leak [E3](https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent.md). Severity rises with the privilege of the exporting component and whether flags suppress user confirmation.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aash-king-co-uk-blog-launching-internal-non-exported-deeplinks-on-facebook.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-1.md
- E3: https://bugbountylibrary.com/r/blog%3Agithub-blog-security-how-we-found-24-android-vulnerabilities-using-our-open-source-ai-security-agent.md