# Implicit broadcast and PendingIntent leaks

Sensitive data or capability sent via implicit broadcast or mutable PendingIntent without a permission

_Area: Mobile app security. Seen in 3 disclosed reports; 2 confirmed bounties: $250 and $560; latest 2022-05-27. Updated 2026-10-24._

## How it works
Android lets an app hand data or a capability to "whoever is listening" when it uses an implicit broadcast (an action string, no target component) or an implicit/mutable PendingIntent. The developer assumes only their own app receives it, but any installed app can register a receiver for the same action, or a NotificationListener can retrieve and rewrite a PendingIntent from a notification. Nothing checks the caller, so the data or the app's own permissions flow to the attacker [E1](https://bugbountylibrary.com/r/h1%3A1161401.md)[E2](https://bugbountylibrary.com/r/h1%3A56002.md)[E3](https://bugbountylibrary.com/r/h1%3A185862.md).

## Where it shows up
- `sendBroadcast`/`sendOrderedBroadcast` with an action string and no receiver-permission argument, carrying tokens, cookies, headers, bodies, or location [E2](https://bugbountylibrary.com/r/h1%3A56002.md)[E3](https://bugbountylibrary.com/r/h1%3A185862.md).
- Intra-app messaging done through implicit broadcasts instead of explicit intents or local callbacks [E2](https://bugbountylibrary.com/r/h1%3A56002.md).
- `PendingIntent.getActivity/getService/getBroadcast` without an explicit component and without `FLAG_IMMUTABLE`, placed in a notification [E1](https://bugbountylibrary.com/r/h1%3A1161401.md).
- Notification builders that attach clipData or extras to a PendingIntent the app later relies on [E1](https://bugbountylibrary.com/r/h1%3A1161401.md).

## How to review
The invariant: every broadcast or PendingIntent that carries sensitive data or grants a capability must be either explicit (named component) or protected by a signature-level receiver permission, and every PendingIntent must be immutable unless mutation is required and the mutator is trusted. Check each `sendBroadcast` call for a permission argument and an explicit package/component; check each PendingIntent for a set component and `FLAG_IMMUTABLE`. For notifications, confirm the PendingIntent cannot be retrieved and redirected to another package [E1](https://bugbountylibrary.com/r/h1%3A1161401.md).

## Variants seen
- Implicit, mutable PendingIntent in a download notification, mutated to inherit the app's contacts permission [E1](https://bugbountylibrary.com/r/h1%3A1161401.md).
- Unprotected implicit broadcast carrying full API responses, cookies and access tokens [E2](https://bugbountylibrary.com/r/h1%3A56002.md).
- Unprotected implicit broadcast leaking GPS location to any app without permissions [E3](https://bugbountylibrary.com/r/h1%3A185862.md).

## Impact and severity
Leaked credentials enabled account hijack [E2](https://bugbountylibrary.com/r/h1%3A56002.md); leaked location enabled silent tracking [E3](https://bugbountylibrary.com/r/h1%3A185862.md); the PendingIntent flaw exposed contacts and logs [E1](https://bugbountylibrary.com/r/h1%3A1161401.md). Severity is high when tokens or permissions are involved. It worsens when the broadcast fires on every request or the PendingIntent is reachable by any NotificationListener, making the leak continuous and passive.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1161401.md
- E2: https://bugbountylibrary.com/r/h1%3A56002.md
- E3: https://bugbountylibrary.com/r/h1%3A185862.md