Privilege Management: Dangerous Intent Permission

Some permissions specified for Intents are more dangerous to use than others, as they can unintentionally enable other applications to read from or write to resources.

Some permissions on Intents are there to be able to grant permissions to external programs that do not usually have that permission, such as FLAG_GRANT_READ_URI_PERMISSION and FLAG_GRANT_WRITE_URI_PERMISSION. If a malicious program is able to intercept this intent, it will then gain permission to read from or write to the specified URI. These can often be more susceptible to being intercepted if the intent is implicit rather than explicit.

Example 1: The following code sets the permission flag to enable writing to a URI within the Intent.

  myIntent.setFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION);