android-intent-security

Validate any nested Intent before launching it by checking the target package matches your app and the target component is exported. With AndroidX Core 1.9.0+, use IntentSanitizer with an explicit allowlist of components, actions, and extras, calling sanitizeByThrowing or sanitizeByFiltering.

Use PendingIntent.FLAG_IMMUTABLE by default for alarms and notifications so receivers cannot alter the Intent. Use FLAG_MUTABLE only for cases like inline notification replies, and always set an explicit target component on the base Intent to prevent hijacking.

Retrieve the calling UID with Binder.getCallingUid, resolve it via PackageManager.getPackagesForUid, and verify the caller's signing certificate with hasSigningCertificate. Perform this check inside each Binder transaction method, not in onBind, since binder connections are cached.

Set android:readPermission and android:writePermission on the provider, keep grantUriPermissions false unless temporary access is required, and use signature-level permissions for family apps. Parameterize all query selections and enable strict SQLiteQueryBuilder validation to block SQL injection.

Activities using singleTop launch mode receive new Intents via onNewIntent, which attackers can exploit through warm boot paths. Apply the same validation used in onCreate, call setIntent to update the active reference, and reject payloads failing security checks.

It covers only local inter-component and inter-app communication security on Android. It does not address network security, web integration, or host-to-server communication, and it requires minimum API level 23 with AndroidX Core 1.9.0 or higher.