Android applications can receive broadcasts from the system or other applications through registered broadcast receivers.

Why is this an issue?

A broadcast receiver registered or declared without a broadcast permission can receive intents from any application on the device, making it an unrestricted entry point into the application. Malicious or compromised applications can send crafted broadcasts that trigger unintended behavior, bypass access controls, or feed untrusted data into the application’s processing logic. This rule raises an issue when a receiver is registered in code without a broadcastPermission argument, or when a receiver is declared in the manifest as exported without an android:permission attribute.

What is the potential impact?

Unauthorized access

An attacker controlling a malicious application can send arbitrary broadcasts to the unprotected receiver, potentially triggering sensitive operations such as changing application state or invoking privileged functionality without the user’s knowledge.

Data injection

Without restriction, any application can supply arbitrary intent data to the receiver. If that data is processed without validation, it can lead to logic errors or further exploitation within the application.

How to fix it

Code examples

The following manifest declares a receiver that is exported without any permission restriction, allowing any application on the device to send broadcasts to it.

Noncompliant code example

<receiver android:name=".MyBroadcastReceiver" android:exported="true">  <!-- Noncompliant -->
    <intent-filter>
        <action android:name="android.intent.action.AIRPLANE_MODE"/>
    </intent-filter>
</receiver>

Compliant solution

Enforce permissions by specifying which senders are allowed:

<receiver android:name=".MyBroadcastReceiver"
    android:permission="android.permission.SEND_SMS"
    android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.AIRPLANE_MODE"/>
    </intent-filter>
</receiver>

Alternatively, disable export of the receiver so that it only receives system intents:

<receiver android:name=".MyBroadcastReceiver" android:exported="false">
    <intent-filter>
        <action android:name="android.intent.action.AIRPLANE_MODE"/>
    </intent-filter>
</receiver>

Resources

Documentation

Android documentation - Broadcast Overview - Security considerations and best practices