hard20 pts · first answer countsmobile-securityandroid

Exported activity loading any URL

An exported Android activity reads a "url" extra from its intent and loads it in a WebView with JavaScript enabled and a JavaScript interface to native code. What is the risk?

A.None; exported only controls whether the activity gets a launcher icon, and other apps can never start an activity in a different app with their own extrasB.Only slower page loadsC.Exported only matters on rooted phonesD.Any installed app can launch it with a malicious URL that then calls the native bridge; validate the URL against an allowlist, or set exported to false if outside apps do not need it

Discussion 0

Join free to post in the discussion.

Exported activity loading any URL

Discussion 0

Related questions