🚨 Android App Security Insight ( Static Analysis)
🎯 Exposed SplashScreen with Intent Injection Risk
Over the past few weeks, I’ve been analyzing a real-world Android application, digging deep into the AndroidManifest.xml file — line by line. While reviewing the exported components, something caught my eye: a launcher activity named SplashScreen.
To understand how it worked, I started tracing its behavior, simulating different launch scenarios, and inspecting the app’s intent handling.
💥 And then — Boom! — I noticed that the SplashScreen activity was processing external intent extras without validation.
🔹 NOTIFICATION_TARGET_DATA (String)
🔹 NOTIFICATION_TARGET_ACTION (Integer)
🧪 I simulated this using ADB:
adb shell am start -n net…...selfcare./.authentication.SplashScreen \
— es NOTIFICATION_TARGET_DATA "https://phish.evil.com" \
— ei NOTIFICATION_TARGET_ACTION 1
✅ The app accepted and processed the intent, suggesting improper input handling. The app accepted and processed the injected intent.
🔍 Decompiled analysis confirmed this. Here’s a portion of the SplashScreen class:
public final class SplashScreen extends BaseActivity<ActivitySplashScreenBinding, BaseViewModel> implements View.OnClickListener {
private HashMap _$_findViewCache;
private boolean fromLogout;
private boolean fromNotification;
private String targetData;
private final long SPLASH_TIME = 3000;
private int targetAction = -1;
}
These fields (targetData, targetAction, and fromNotification) are directly populated from incoming intent values — likely via getIntent().getStringExtra(…), etc.
Get Akanbi Oluwakunle Johnson’s stories in your inbox
Join Medium for free to get updates from this writer.
🔥 Why This Is Dangerous:
❗ Exported activities that process untrusted intents can lead to:
🚪 Authentication bypass
🌐 Phishing via WebView
🧨 Intent injection attacks
📉 Brand or user trust damage
🛡️ Developer Tips:
✅ Add android:exported=”false” where external access isn’t needed
✅ Always validate & sanitize data from intents
✅ Never blindly trust values like targetAction or fromNotification
💬 Let’s Discuss:
🔹 Have you come across similar intent abuse vectors?
🔹 Do you validate extras in your launcher activities or push handlers?
🔹 Should Android enforce stronger defaults for exported components?
Drop your thoughts below 👇
Let’s secure mobile apps together 🛡️📱
#AndroidSecurity #MobileAppSecurity #BugBounty #ReverseEngineering #CyberSecurity #IntentInjection #SecureCoding #DevSecOps #AppSec #MalwareAnaly
