Intent Manipulation: Implicit Pending Intent

An implicit PendingIntent has been detected. Implicit pending intents might result in security vulnerabilities such as denial of service, private and system information leakage, and privilege escalation.

Android Intents are used to bind applications and application components together by providing instruction on actions that a given component performs. Pending intents are created to deliver the Intent at a later time. Implicit intents facilitate the calling of intents from any given external component, using a general name and filter to determine execution.

When an implicit Intent is created as a PendingIntent, this might allow for the Intent to be sent to an unintended component that runs outside of the intended temporal context, leaving the system vulnerable to exploit vectors such as denial of service, private and system information leakage, and privilege escalation.

Example 1: The following code uses an implicit PendingIntent.

...
val imp_intent = Intent()
val flag_mut = PendingIntent.FLAG_MUTABLE
val pi_flagmutable_impintintent = PendingIntent.getService(
    this,
    0,
    imp_intent,
    flag_mut
)
...