Hello everybody,
I've noticed that when an application has GET_TASKS permission it can
retrieve the data sent between two Activities in other application, where
second Activity is not exported like in this example:
<activity android:name=".FirstActivity" >
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
<activity android:name=".SecondActivity" />
somwhere in FirstActivity:
Intent intent = new Intent(this, SecondActivity.class);
intent.putExtra("any_key", "any_value");
startActivity(intent);
any_key + any_value pair can be read from application that has GET_TASKS
permission.
Does that mean we should not send sensitive data between exported and
private Activity?
--
You received this message because you are subscribed to the Google Groups
"Android Security Discussions" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at
http://groups.google.com/group/android-security-discuss?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.
